AI agents

CVE-2026-44285 is a Server-Side Request Forgery (SSRF) flaw in FastGPT, an AI Agent building platform, prior to 4.15.0-beta1. An authenticated attacker can bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to internal network services. The flaw is reached through an incomplete fix in the dataset preview endpoint /api/core/dataset/file/getPreviewChunks when the externalFile data import type is used.

From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with Path.glob() and Path.rglob() and read matches with Path.read_text(), following symbolic links transparently. A symlink committed inside a remote APM dependency under .apm/prompts/ or .apm/agents/ is preserved into apm_modules/ on clone, then dereferenced during integration, and the resolved content is written as a regular file into the project's deploy directories. The package content_hash, the pre-deploy SecurityGate scan, and apm audit do not flag this.

Microsoft APM, an open-source dependency manager for AI agents, is affected prior to 0.8.12. When it normalizes marketplace plugins, it copies components referenced in plugin.json into .apm/ without checking that the attacker-controlled agents, skills, commands, and hooks paths stay inside the plugin directory. A malicious plugin can use absolute or ../ traversal paths to copy arbitrary readable files or directories from the installer's machine during apm install.

CVE-2026-43993 affects JunoClaw, an agentic AI platform built on Juno Network, before 0.x.y-security-1. The WAVS bridge's computeDataVerify called fetch() on agent-supplied URLs without validating scheme, port, or resolved IP, which is a server-side request forgery (CWE-918). NIST has not yet provided an NVD assessment.

CVE-2026-43991 affects JunoClaw, an agentic AI platform built on Juno Network, before 0.x.y-security-1. A substring-based blocklist in the plugin-shell command-safety check, applied to the raw command string rather than the parsed first token, can be bypassed by adversarial argument constructions. When combined with the companion advisory, this allows unauthorized command execution on the host.

CVE-2026-43990 affects JunoClaw, an agentic AI platform built on Juno Network, prior to 0.x.y-security-1. The plugin-shell run_command function wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell parser, so shell metacharacters in agent-supplied arguments were interpreted as command syntax. The issue is classified as CWE-77 and CWE-78, and NVD published it on 05/12/2026.

CVE-2026-43989 affects JunoClaw, an agentic AI platform built on Juno Network, prior to 0.x.y-security-1. The upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes that path resolved to, without validating location, symlink target, file size, or file format. The flaw is classified as CWE-20, CWE-22, CWE-59 and CWE-73.

CVE-2026-44286 affects FastGPT, an AI Agent building platform, prior to version 4.14.17. An unauthenticated attacker, or an authenticated user with App editing privileges, can make the fetchData function in the lafModule workflow node send arbitrary HTTP requests to internal or private network addresses. The function uses axios on user-controlled URLs without checking them against the isInternalAddress blocklist guard.

FastGPT versions 4.14.11 and prior are affected by CVE-2026-42345. The isInternalAddress() function in packages/service/common/system/utils.ts blocks cloud metadata endpoints with a fullUrl.startsWith() check against a hardcoded list, which at least 7 URL encoding techniques bypass to reach the same metadata service. The broader private IP check is disabled by default because CHECK_INTERNAL_IP defaults to false.