CVE-2026-26075: Cross-Site Request Forgery (CSRF) in FastGPT
FastGPT is an AI Agent building platform. Due to the fact that FastGPT's web page acquisition nodes, HTTP nodes, etc. need to initiate data acquisition requests from the server, there are certain security issues. In addition to implementing internal network isolation in the deployment environment, this optimization has added stricter internal network address detection. This vulnerability is fixed in 4.14.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26075?
The severity of CVE-2026-26075 is considered to be high due to its potential for allowing unauthorized actions by exploiting CSRF vulnerabilities.
How do I fix CVE-2026-26075?
To fix CVE-2026-26075, upgrade FastGPT to version 4.14.8 or later where the CSRF issue has been addressed.
Who is affected by CVE-2026-26075?
CVE-2026-26075 affects users running FastGPT versions up to and including 4.14.7.
What type of attack is associated with CVE-2026-26075?
CVE-2026-26075 is associated with Cross-Site Request Forgery (CSRF) attacks, which can allow unauthorized commands to be transmitted from a user.
Can CVE-2026-26075 lead to data theft?
Yes, exploiting CVE-2026-26075 can potentially lead to data theft, as attackers may perform unauthorized actions on behalf of the victim.