{"data":{"id":"388d5fe8-0a2b-4537-b09c-42d6221a6cad","title":"CVE-2026-26075: FastGPT is an AI Agent building platform. Due to the fact that FastGPT's web page acquisition nodes, HTTP nodes, etc…","summary":"CVE-2026-26075 affects FastGPT, an AI Agent building platform. Its web page acquisition nodes and HTTP nodes initiate data acquisition requests from the server, which the source describes as a security issue. The fix adds stricter internal network address detection, and the source rates it CVSS 4.0 6.9 MEDIUM (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) per GitHub, Inc.; NVD has not yet provided an assessment.","solution":"Fixed in 4.14.7. In addition to implementing internal network isolation in the deployment environment, stricter internal network address detection has been added.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-26075","publishedAt":"2026-02-12T22:16:06.817Z","cveId":"CVE-2026-26075","cweIds":["CWE-352"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["FastGPT"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"FastGPT server-side request handling in web page and HTTP nodes","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0012,"epssCheckedAt":"2026-11-04T06:10:13.969Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T00:12:33.888Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}