High 8.6Published Jul 7, 2026

CVE-2026-55418FastGPT is an open source AI knowledge base platform.

Updated under an hour ago (2026-10-19 11:20 UTC)

Does this affect you?

It lists no affected products yet. Add what you run and Signals checks it as products are added.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Exploited in the last 30 days

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object keys are global within the bucket and carry the tenant id only as a path segment, an attacker can supply another team's key and obtain its file contents through the chat-file presign endpoint or dataset preview endpoint. This issue is fixed in version v4.15.0-beta5.

CVSS: 8.6 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weakness (CWE): CWE-639
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Deferred
Record last updated: Jul 9, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

No affected products are listed yet.

References

https://github.com/labring/FastGPT/commit/decb6d2fb1417fb9e2bca145d2dcc9cbcf06396c
https://github.com/labring/FastGPT/pull/7104
https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5
https://github.com/labring/FastGPT/security/advisories/GHSA-6rxv-p43w-mmx5

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.