CVE-2026-44285

FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, a Server-Side Request Forgery (SSRF) vulnerability allows an authenticated attacker to bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to internal network services. This is achieved by exploiting an incomplete fix in the dataset preview endpoint /api/core/dataset/file/getPreviewChunks when utilizing the externalFile data import type. This vulnerability is fixed in 4.15.0-beta1.

• CWE-918

• https://github.com/labring/FastGPT/security/advisories/GHSA-c65v-7vx6-f8m3
• https://github.com/labring/FastGPT/security/advisories/GHSA-c65v-7vx6-f8m3

Published

May 29, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44278A use of hard-coded cryptographic key vulnerability in Forti…5.5
• CVE-2026-44279An improper export of android application components vulnera…5.5
• CVE-2026-4428A logic error in CRL distribution point validation in AWS-LC…9.1
• CVE-2026-44281GLPI is a free asset and IT management software package. Sta…7
• CVE-2026-44283etcd is a distributed key-value store for the data of a dist…4.3
• CVE-2026-44284FastGPT is an AI Agent building platform. Prior to version 4…6.3
• CVE-2026-44286FastGPT is an AI Agent building platform. Prior to version 4…2.3
• CVE-2026-44287FastGPT is an AI Agent building platform. Prior to 4.15.0-be…6.3
• CVE-2026-44288protobufjs compiles protobuf definitions into JavaScript (JS…5.3
• CVE-2026-44289protobufjs compiles protobuf definitions into JavaScript (JS…7.5
• CVE-2026-4429The OSM – OpenStreetMap plugin for WordPress is vulnerable t…6.4
• CVE-2026-44290protobufjs compiles protobuf definitions into JavaScript (JS…7.5