CVE-2026-54602: FastGPT Information Disclosure Flaw

CVE-2026-54602 Overview

CVE-2026-54602 is an authorization flaw in FastGPT, a knowledge-based AI application platform developed by labring. The GET /api/core/ai/record/getRecord endpoint authenticates the caller but loads large language model (LLM) request and response traces using only the requestId parameter. The endpoint does not enforce team scoping, so any authenticated user who knows or guesses a requestId can read another team's prompts, retrieved Retrieval-Augmented Generation (RAG) chunks, and model completions. The issue is categorized as an Insecure Direct Object Reference [CWE-639] and is fixed in FastGPT version 4.15.0.

Critical Impact
Any authenticated FastGPT user can retrieve confidential LLM prompts, RAG document chunks, and model completions belonging to other tenants when a requestId is known.

Affected Products

FastGPT versions prior to 4.15.0
Self-hosted FastGPT deployments serving multiple teams or tenants
FastGPT cloud instances relying on the vulnerable getRecord endpoint

Discovery Timeline

2026-07-07 - CVE-2026-54602 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54602

Vulnerability Analysis

FastGPT exposes GET /api/core/ai/record/getRecord to authenticated users so operators can inspect stored LLM interaction traces. The endpoint validates that the request carries a valid session but does not check whether the requested trace belongs to the caller's team. A trace is retrieved solely by its requestId value. Once authenticated, any user can supply an arbitrary requestId and receive the associated prompt content, retrieved RAG chunks, and generated completions.

This exposes highly sensitive material. LLM prompts frequently contain proprietary instructions, customer data, and API tool arguments. RAG chunks reveal the underlying knowledge base documents ingested by other teams. Completions can echo credentials, personally identifiable information (PII), or internal business logic embedded in prompts.

Root Cause

The root cause is missing tenant isolation in the record lookup path. The handler performs authentication but omits an authorization check against teamId. This pattern matches [CWE-639] Authorization Bypass Through User-Controlled Key. The requestId is a server-generated identifier, yet its knowledge alone is sufficient to fetch records across tenant boundaries.

Attack Vector

Exploitation requires only a low-privilege authenticated account on the same FastGPT instance. An attacker enumerates or obtains requestId values through logs, referrer leaks, shared debugging output, or predictable identifier patterns. The attacker then issues repeated GET /api/core/ai/record/getRecord?requestId=<value> requests and harvests the responses. No user interaction from the victim team is required.

// Vulnerable request pattern (sanitized)
GET /api/core/ai/record/getRecord?requestId=<target-request-id> HTTP/1.1
Host: fastgpt.example.com
Cookie: <attacker-session>

// Server returns record without verifying that
// record.teamId == session.teamId

The upstream fix is tracked in the GitHub Security Advisory GHSA-6vx6-f72r-74cg and the corresponding GitHub commit 60c62b7.

Detection Methods for CVE-2026-54602

Indicators of Compromise

Unusually high request volume from a single authenticated account against /api/core/ai/record/getRecord.
Sequential or brute-forced requestId values in access logs for the record endpoint.
Successful record retrievals where the response teamId differs from the caller's session teamId.

Detection Strategies

Enable verbose application logging for the getRecord handler and log the caller's teamId alongside the record's teamId for every response.
Alert on any request where those two identifiers do not match, treating each occurrence as a confirmed cross-tenant read.
Deploy a web application firewall (WAF) rule that rate-limits getRecord calls per session and flags rapid enumeration of requestId values.

Monitoring Recommendations

Retain FastGPT reverse proxy logs and correlate requestId parameters with the authenticated session identifier.
Monitor outbound traffic from FastGPT for large sequential exports that could indicate bulk trace exfiltration.
Review audit trails for administrative accounts and disable stale sessions that may retain access to the vulnerable endpoint.

How to Mitigate CVE-2026-54602

Immediate Actions Required

Upgrade FastGPT to version 4.15.0 or later on all self-hosted and managed deployments.
Rotate any secrets, API keys, or credentials that may have appeared in stored prompts or completions before the upgrade.
Audit access logs for /api/core/ai/record/getRecord requests since deployment to identify potential cross-tenant reads.

Patch Information

The maintainers of FastGPT released version 4.15.0 to add team scoping to the record retrieval path. Details are published in the GitHub Security Advisory GHSA-6vx6-f72r-74cg and the fix commit is available at GitHub commit 60c62b7. Administrators should validate that the running build reports version 4.15.0 or higher after patching.

Workarounds

Restrict network access to the FastGPT API to trusted operator IP ranges until the patch is applied.
Block or proxy-filter requests to /api/core/ai/record/getRecord at the reverse proxy for non-administrative accounts.
Reduce the retention window for stored LLM traces so that any exposed records contain minimal historical data.

bash

# Example NGINX rule to block the vulnerable endpoint pre-patch
location = /api/core/ai/record/getRecord {
    allow 10.0.0.0/24;   # trusted operator subnet
    deny all;
    proxy_pass http://fastgpt_upstream;
}