CVE-2026-50562: FastGPT Privilege Escalation Vulnerability

CVE-2026-50562 Overview

FastGPT is a knowledge-based AI application platform maintained by labring. CVE-2026-50562 affects its GitHub Actions continuous integration pipeline. Artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be consumed by privileged workflow_run jobs. Attackers who submit a malicious pull request can inject Docker images into the trusted build context. These images are then pushed to GitHub Container Registry (GHCR) and, for documentation previews, deployed to a Kubernetes cluster using the secrets.KUBE_CONFIG_CN credential. The flaw is classified under CWE-266: Incorrect Privilege Assignment.

Critical Impact
Attacker-controlled container images can reach production infrastructure and reveal Kubernetes cluster credentials.

Affected Products

FastGPT at commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier
FastGPT GitHub Actions workflow preview-docs-build.yml / preview-docs-push.yml
FastGPT GitHub Actions workflow preview-fastgpt-build.yml / preview-fastgpt-push.yml

Discovery Timeline

2026-07-15 - CVE-2026-50562 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-50562

Vulnerability Analysis

The vulnerability stems from an unsafe combination of the pull_request and workflow_run triggers in FastGPT's GitHub Actions. The preview-docs-build.yml and preview-fastgpt-build.yml workflows run in the low-privilege pull_request context and build Docker images from attacker-supplied source code. These artifacts are then downloaded by preview-docs-push.yml and preview-fastgpt-push.yml, which execute in the privileged workflow_run context with access to repository secrets. The downstream workflows push the untrusted images to GHCR and, for documentation previews, deploy them to a Kubernetes cluster using secrets.KUBE_CONFIG_CN. Attackers can weaponize this trust boundary by opening a pull request that modifies the document/ tree or FastGPT build context.

Root Cause

The root cause is incorrect privilege assignment across workflow boundaries. Build artifacts produced from untrusted forks are treated as trusted by the push workflows. No verification confirms that the downloaded artifact originated from a reviewed commit on the base branch.

Attack Vector

An external attacker opens a pull request that plants a malicious Dockerfile or build script. The pull_request workflow builds the image and uploads it as an artifact. The workflow_run trigger then fires with elevated privileges, retrieves the artifact, pushes the tampered image to GHCR, and deploys it with the Kubernetes secret. Refer to the FastGPT GitHub Security Advisory GHSA-rvgc-2c29-g876 for technical details.

Detection Methods for CVE-2026-50562

Indicators of Compromise

Unexpected image tags published to the FastGPT GHCR namespace that correspond to pull requests from external forks.
workflow_run job logs showing artifact downloads originating from unreviewed pull request commits.
Kubernetes audit events tied to secrets.KUBE_CONFIG_CN that deploy container images not built from the main branch.

Detection Strategies

Audit GitHub Actions run history for preview-docs-push.yml and preview-fastgpt-push.yml executions triggered by external contributor pull requests.
Review GHCR image provenance and compare digest signatures to trusted commits on protected branches.
Inspect Kubernetes deployment history in the documentation preview cluster for workloads pulling images tagged with pull request numbers.

Monitoring Recommendations

Enable GitHub Actions workflow logging and forward events to a central data lake for correlation.
Alert on any workflow_run job that consumes artifacts produced by a fork-originated pull_request event.
Monitor Kubernetes API audit logs for pod creations that reference newly pushed GHCR tags outside the release pipeline.

How to Mitigate CVE-2026-50562

Immediate Actions Required

Disable or gate the preview-docs-push.yml and preview-fastgpt-push.yml workflows until the upstream fix is applied.
Rotate secrets.KUBE_CONFIG_CN and any GHCR write tokens that were reachable by the vulnerable workflows.
Remove untrusted images from GHCR that were pushed via preview pipelines during the exposure window.

Patch Information

Apply the mitigation guidance published in the FastGPT GitHub Security Advisory GHSA-rvgc-2c29-g876. Update FastGPT to a revision later than commit 22ebfacbb43311e9b73294040ae0eb87390c6bba that restructures the preview workflows.

Workarounds

Validate artifact provenance in the workflow_run job by verifying the source commit SHA against the base branch before use.
Require manual approval for pull requests from first-time or external contributors using GitHub environment protection rules.
Split build and deploy responsibilities so that only artifacts produced from trusted branches can access deployment secrets.

bash

# Configuration example: restrict workflow_run to trusted PR sources
# .github/workflows/preview-fastgpt-push.yml
jobs:
  push:
    if: >-
      github.event.workflow_run.conclusion == 'success' &&
      github.event.workflow_run.head_repository.full_name == github.repository
    runs-on: ubuntu-latest
    environment: production-preview   # requires reviewer approval
    steps:
      - name: Verify artifact source commit
        run: |
          echo "Head SHA: ${{ github.event.workflow_run.head_sha }}"
          git fetch origin main
          git merge-base --is-ancestor ${{ github.event.workflow_run.head_sha }} origin/main