https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T04:30:03.703425+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-44286 CVE-2026-44286 — FastGPT: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation 2026-10-07T04:30:03.722038+00:00

Affected: labring FastGPT

FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users with App editing privileges) to send arbitrary HTTP requests to internal/private network addresses. The fetchData function in the lafModule workflow node uses axios to fetch user-controlled URLs without validating them against the application's internal network blocklist guard (isInternalAddress), bypassing SSRF protections. This issue has been patched in version 4.14.17.