CVE-2026-54607 Details
Description
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without FastGPT's internal-address guard and returns fetched content inline, allowing an authenticated team member to read internal services or cloud metadata. This issue is fixed in version 4.15.0-beta4.
A server-side request forgery (SSRF) vulnerability has been identified in FastGPT versions prior to 4.15.0-beta4. The issue arises in the HTTP-tool OpenAPI schema importer, which only validates the top-level URL against an internal-address blocklist before passing it to SwaggerParser.bundle. This remote reference resolver fetches $ref URLs without applying FastGPT's internal-address guard, allowing an authenticated team member to access internal services or cloud metadata. The vulnerability is particularly concerning on cloud deployments, where it can expose sensitive instance metadata and IAM credentials.
Users are advised to update to FastGPT version 4.15.0-beta4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/labring/FastGPT/security/advisories/GHSA-72hf-5382-2mq9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/labring/FastGPT/commit/1d7b8768aecd53ae59372fd68b10af0e80722c79 | [email protected] | Source CodeVendor |
| https://github.com/labring/FastGPT/pull/7073 | [email protected] | Source CodeVendor |
| https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta4 | [email protected] | Release NotesVendor |
| https://github.com/labring/FastGPT/security/advisories/GHSA-72hf-5382-2mq9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Labring FastGPT | >= 4.15.0, < 4.15.0-beta4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |