{"data":{"id":"b6ce2328-5bae-4e53-84f0-5d97723c1d23","title":"CVE-2026-44286: FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery…","summary":"CVE-2026-44286 affects FastGPT, an AI Agent building platform, prior to version 4.14.17. An unauthenticated attacker, or an authenticated user with App editing privileges, can make the fetchData function in the lafModule workflow node send arbitrary HTTP requests to internal or private network addresses. The function uses axios on user-controlled URLs without checking them against the isInternalAddress blocklist guard.","solution":"Fixed in 4.14.17.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44286","publishedAt":"2026-05-08T23:16:39.647Z","cveId":"CVE-2026-44286","cweIds":["CWE-918"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["FastGPT"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"FastGPT unauthenticated SSRF through lafModule fetchData in workflow node","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00228,"epssCheckedAt":"2026-11-08T06:09:29.163Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-03T06:12:08.085Z","patchAvailable":null,"disclosureDate":"2026-05-08T23:16:39.647Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}