CVE-2026-44286CWE-918

FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation

Low · published May 8, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users with App editing privileges) to send arbitrary HTTP requests to internal/private network addresses. The fetchData function in the lafModule workflow node uses axios to fetch user-controlled URLs without validating them against the application's internal network blocklist guard (isInternalAddress), bypassing SSRF protections. This issue has been patched in version 4.14.17.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00387 · 31.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-08T22:17Z
EPSS history
Timeline
  • 08 MAY 22:17Z
    FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation
    cvelistv5