CVE-2026-61644

FastGPT before version 4.15.2 has unauthorized access to WeChat (iLink) share-channel endpoints using only the public shareId. An unauthenticated attacker can hijack a victim's WeChat channel, replace bot credentials, and expose private app responses.

In FastGPT up to commit 22ebfacbb43311e9b73294040ae0eb87390c6bba, artifacts built from untrusted pull request code in GitHub Actions workflows can be downloaded by privileged workflow_run jobs, allowing an attacker to push controlled Docker images to GHCR and, for documentation previews, deploy with the secret KUBE_CONFIG_CN.

FastGPT versions 4.14.10 through 4.14.13 contain an unauthenticated Remote Code Execution (RCE) vulnerability in the agent-sandbox component. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080), allowing any user with network access to bypass authentication and gain full control over the sandbox environment.

FastGPT before version 4.14.9.5 exposes the /api/core/app/httpTools/runTool endpoint without authentication. It acts as a full HTTP proxy, allowing attackers to make arbitrary HTTP requests from the server.

In FastGPT from version 4.14.17 to 4.15.0-beta5, an authenticated user can save a workflow node referencing another user's private HTTP toolset using a crafted tool ID. The lack of proper authorization checks in the workflow save and execution path allows execution of the victim-owned HTTP tool.

FastGPT version 4.15.0-beta4 has a vulnerability in reverse-call endpoints under /api/invoke/* that authenticate only via a JWT signed with a default constant secret 'token'. An unauthenticated attacker can self-sign an HS256 JWT and access cross-tenant user PII or write arbitrary content to chat files.

FastGPT before version 4.15.0-beta5 has an SSRF vulnerability where the guard validates only the initial request URL, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an attacker-controlled public URL that redirects to cloud metadata, loopback, or internal services that the guard would block on direct request, and the HTTP node returns the response body to the workflow caller.

In FastGPT prior to v4.15.0-beta5, two file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint.

In FastGPT prior to version 4.15.0-beta4, the HTTP-tool OpenAPI schema importer validates only the top-level URL before passing it to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without FastGPT's internal-address guard and returns fetched content inline, allowing an authenticated team member to read internal services or cloud metadata.

In FastGPT before version 4.15.0, the GET /api/core/ai/record/getRecord endpoint authenticates the caller but loads LLM request and response traces only by requestId without team scoping. This allows any authenticated user to read another team's prompts, retrieved RAG chunks, and completions if the requestId is known.