Executive brief
FastGPT, an AI application platform, contains a security flaw in how it verifies internal plugin requests. Due to a default or missing security token in certain deployment templates, an unauthorized person could bypass authentication. This allows an attacker to access private user information across different accounts or upload malicious files into chat sessions, potentially compromising data privacy and system integrity.
Technical details
FastGPT version 4.15.0-beta4 is vulnerable to authentication bypass in its plugin 'reverse-call' endpoints (under /api/invoke/*). The application relies on a JWT signed with the INVOKE_TOKEN_SECRET for authentication; however, this secret defaults to a hard-coded string ('token') and was omitted from official deployment templates, leaving many installations with the default value. An unauthenticated remote attacker can generate a self-signed HS256 JWT using the known default secret. This allows access to /api/invoke/userInfo to disclose cross-tenant PII via manipulated tmbId values, or /api/invoke/fileUpload to inject attacker-controlled content into chat files. The vulnerability is addressed in version 4.15.0-beta5 by requiring a unique secret configuration and removing the runtime default.
Affected products
- labring FastGPT 4.15.0-beta4
Timeline
- 2026-06-23: patched: Fix committed to main branch
- 2026-06-24: advisory: Release v4.15.0-beta5 published
- 2026-07-15: disclosed: CVE published to NVD