CVE-2026-50562 Details

A vulnerability exists in FastGPT, a knowledge-based AI application platform, allowing untrusted pull request artifacts to be promoted by privileged workflows. This issue is present in versions through commit 22ebfacbb43311e9b73294040ae0eb87390c6bba. The vulnerability arises because artifacts built from untrusted pull request code can be downloaded by privileged 'workflow_run' jobs, which then push attacker-controlled Docker images to the GitHub Container Registry (GHCR) or deploy them to a Kubernetes environment using sensitive credentials.

Do not promote artifacts from untrusted pull request code in privileged workflows. Implement a trusted-origin gate before any push or deployment actions, and rebuild deployable images from trusted code. If untrusted preview images are necessary, push them to a non-production registry namespace using low-privilege credentials, and avoid deploying such images to Kubernetes clusters with significant privileges or network access.