CVE-2026-26075 MEDIUM

CVE-2026-26075: Cross-Site Request Forgery (CSRF) in FastGPT

Vendor Labring
Product FastGPT
Weakness CWE-352 · CSRF
Published February 12, 2026
Last update February 13, 2026

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

FastGPT is an AI Agent building platform. Due to the fact that FastGPT's web page acquisition nodes, HTTP nodes, etc. need to initiate data acquisition requests from the server, there are certain security issues. In addition to implementing internal network isolation in the deployment environment, this optimization has added stricter internal network address detection. This vulnerability is fixed in 4.14.7.

Key dates

02Disclosure timeline

February 12, 2026 CVE published
February 13, 2026 Record updated

Related vulnerabilities

04Related CVE