{"data":{"id":"d68fad3f-b6a7-4fc1-8fc5-a393a72d53a0","title":"CVE-2026-44285: FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, a Server-Side Request Forgery (SSRF) vulnerability…","summary":"CVE-2026-44285 is a Server-Side Request Forgery (SSRF) flaw in FastGPT, an AI Agent building platform, prior to 4.15.0-beta1. An authenticated attacker can bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to internal network services. The flaw is reached through an incomplete fix in the dataset preview endpoint /api/core/dataset/file/getPreviewChunks when the externalFile data import type is used.","solution":"Fixed in 4.15.0-beta1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44285","publishedAt":"2026-05-29T20:16:24.103Z","cveId":"CVE-2026-44285","cweIds":["CWE-918"],"cvssScore":"7.7","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["FastGPT"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"FastGPT server-side request forgery in dataset preview endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00361,"epssCheckedAt":"2026-10-14T18:05:58.741Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:47:59.342Z","patchAvailable":null,"disclosureDate":"2026-05-29T20:16:24.103Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}