Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users with App editing privileges) to send arbitrary HTTP requests to internal/private network addresses. The fetchData function in the lafModule workflow node uses axios to fetch user-controlled URLs without validating them against the application's internal network blocklist guard (isInternalAddress), bypassing SSRF protections. This issue has been patched in version 4.14.17.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-44286 FastGPT is an AI Agent building platform. Prior to version 4.14.17, an unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authentic… https://www.cve.org/CVERecord?id=CVE-2026-44286
Post summary
CVE-2026-44286 is disclosed as an unauthenticated SSRF flaw in FastGPT (v4.14.17 and earlier), with no exploit, PoC, or remediation details provided.
CVE-2026-44286 Unauthenticated Server-Side Request Forgery in FastGPT Before 4.14.17 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44286
Post summary
The post announces a CVE-2026-44286, noting an unauthenticated SSRF flaw in FastGPT versions prior to 4.14.17, with a link to vulmon for details but lacking any PoC, exploit, or fix information.