CVE-2026-55418: FastGPT Auth Bypass Vulnerability

CVE-2026-55418 Overview

CVE-2026-55418 is an Insecure Direct Object Reference (IDOR) vulnerability in FastGPT, an open source AI knowledge base platform. Two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request. The handlers never verify that the S3 key belongs to the caller's team.

Because S3 object keys are global within the bucket and carry the tenant identifier only as a path segment, an attacker can supply another team's key. The chat-file presign endpoint and dataset preview endpoint return the file contents. The issue is fixed in version v4.15.0-beta5.

Critical Impact
Unauthenticated network attackers can read files belonging to arbitrary tenants by submitting their S3 object keys, breaking multi-tenant isolation in FastGPT deployments.

Affected Products

FastGPT versions prior to v4.15.0-beta5
FastGPT chat-file presign endpoint
FastGPT dataset preview endpoint

Discovery Timeline

2026-07-07 - CVE-2026-55418 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55418

Vulnerability Analysis

The vulnerability stems from a mismatch between authorization scope and resource access. FastGPT stores per-tenant files in a shared S3 bucket, where the tenant identifier appears only as a path segment inside the object key. The affected handlers validate an unrelated resource, such as an appId, before signing or reading an object key that the client supplies directly.

Because the tenant identifier is never cross-checked against the caller's team, any authenticated tenant can submit another tenant's S3 key. The chat-file presign endpoint returns a signed URL that grants read access. The dataset preview endpoint streams the referenced object back to the caller. The flaw is classified under [CWE-639] Authorization Bypass Through User-Controlled Key.

Root Cause

The root cause is missing authorization binding between the S3 object key and the caller's tenant context. The createExternalUrl signing routine documented in packages/service/common/s3/buckets/base.ts explicitly states that it does not perform team, app, dataset, or user ownership checks. The upstream API boundary that invokes it failed to validate ownership before passing the key downstream.

Attack Vector

Exploitation requires only network access to a reachable FastGPT instance. The attacker crafts a request to the chat-file presign or dataset preview endpoint using a valid handle for an unrelated resource they control. They then substitute an S3 object key belonging to a victim tenant. The backend authorizes the unrelated resource and returns a presigned URL or the file body for the victim's object.

typescript

// Patch excerpt from packages/service/common/s3/sources/chat/key.ts
// fix: bind S3 object keys to authorized resources (#7104)
import { isS3ObjectKey } from '../../utils';

/**
 * Parse the S3 key for chat files.
 *
 * The authorization boundary for chat file keys is defined by appId and uid.
 * Any signing or reading must first parse these path segments and bind them to
 * the authenticated context, to avoid signing an arbitrary object key after
 * only validating an unrelated app.
 */
export function parseChatFileS3Key(key: string): {
  appId: string;
  uid: string;
  chatId: string;
  filename: string;
} | null {
  if (!isS3ObjectKey(key, 'chat')) return null;

  const [, appId, uid, chatId, ...filenameParts] = key.split('/');
  const filename = filenameParts.join('/');

  if (!appId || !uid || !chatId || !filename) return null;

  return { appId, uid, chatId, filename };
}

Source: FastGPT commit decb6d2fb1417fb9e2bca145d2dcc9cbcf06396c

Detection Methods for CVE-2026-55418

Indicators of Compromise

Requests to the chat-file presign endpoint or dataset preview endpoint containing S3 object keys whose tenant path segment does not match the caller's team identifier.
Repeated 200 responses following enumeration of appId, uid, or datasetId path segments in submitted S3 keys.
Presigned URL generations followed by S3 GET requests from IP addresses outside the owning tenant's normal client range.

Detection Strategies

Correlate FastGPT application logs with S3 access logs to flag presigned URL issuance where the requesting session's team identifier differs from the S3 key's tenant path segment.
Alert on high-volume presign requests from a single session targeting many distinct appId or uid segments, indicating enumeration.
Baseline normal presign and preview volumes per tenant and alert on outliers.

Monitoring Recommendations

Enable S3 server access logging or CloudTrail data events on the FastGPT bucket and retain records for post-incident review.
Monitor FastGPT reverse-proxy logs for requests to chat-file and dataset preview routes with unusual key structures.
Track the deployed FastGPT version and alert if instances remain below v4.15.0-beta5.

How to Mitigate CVE-2026-55418

Immediate Actions Required

Upgrade FastGPT to v4.15.0-beta5 or later, which enforces key-to-tenant binding in both affected handlers.
Rotate any S3 credentials and presigned URL signing keys used by the vulnerable deployment.
Review S3 access logs for anomalous presign issuance and cross-tenant object reads since deployment of an affected version.

Patch Information

The fix was delivered in FastGPT v4.15.0-beta5 via pull request #7104. The patch introduces per-source key helpers, including parseChatFileS3Key, that parse the tenant path segments from the supplied key and require callers to bind them to the authenticated context before signing or reading. Additional context is in the GHSA-6rxv-p43w-mmx5 advisory.

Workarounds

Restrict network access to FastGPT chat-file and dataset preview endpoints to trusted networks until the upgrade is applied.
Deploy a reverse-proxy or WAF rule that rejects requests where the S3 key path segment does not match the authenticated tenant identifier extracted from the session.
Disable public exposure of the FastGPT instance if upgrading immediately is not feasible.

bash

# Verify the deployed FastGPT version meets the fixed release
docker exec fastgpt sh -c 'cat /app/package.json | grep \"version\"'

# Pull and redeploy the patched release
docker pull ghcr.io/labring/fastgpt:v4.15.0-beta5
docker compose up -d