CVE-2026-44285: FastGPT server-side request forgery in dataset preview endpoint

Summary

CVE-2026-44285 is a Server-Side Request Forgery (SSRF) flaw in FastGPT, an AI Agent building platform, prior to 4.15.0-beta1. An authenticated attacker can bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to internal network services. The flaw is reached through an incomplete fix in the dataset preview endpoint /api/core/dataset/file/getPreviewChunks when the externalFile data import type is used.

Mitigation

Fixed in 4.15.0-beta1.

Topics

• AI agents

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database