CVE-2026-61643 Overview
CVE-2026-61643 is an authorization bypass vulnerability in FastGPT, a knowledge-based AI application platform. The flaw exists in versions from 4.14.17 up to 4.15.0-beta5. An authenticated user can save a workflow node that references another user's private HTTP toolset by crafting a saved tool identifier such as http-<victim_toolset_app_id>/<tool_name>. The toolset routes enforce access control, but the workflow save and runtime code paths omit the same authorization check on the referenced toolset. Consequently, requests to /api/v2/chat/completions resolve the saved reference and execute the victim-owned HTTP tool. The vulnerability is tracked under CWE-863: Incorrect Authorization.
Critical Impact
Authenticated attackers can invoke another user's private HTTP tools through crafted workflow references, breaking tenant isolation and enabling unauthorized execution of victim-owned integrations.
Affected Products
- FastGPT 4.14.17 through 4.15.0-beta4
- FastGPT workflow engine and /api/v2/chat/completions runtime
- FastGPT HTTP toolset integration component
Discovery Timeline
- 2026-07-15 - CVE-2026-61643 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-61643
Vulnerability Analysis
FastGPT allows users to build workflows composed of nodes that reference reusable toolsets, including HTTP toolsets that call external APIs. Toolsets are scoped to their owning user or team, and dedicated toolset routes reject unauthorized reads or executions. The workflow save path and the chat completions runtime path do not replicate the toolset ownership check. When a workflow node stores a saved tool identifier in the format http-<victim_toolset_app_id>/<tool_name>, the runtime dereferences that identifier and executes the target tool under the workflow context rather than the caller's context.
This is an authorization flaw rather than an authentication flaw. The attacker must hold valid FastGPT credentials, but no additional privileges beyond a standard user account are required to craft the reference.
Root Cause
The root cause is inconsistent enforcement of ownership checks across code paths. Toolset routes correctly validate that the requesting user owns or has been granted access to the referenced toolset. The workflow persistence layer and the /api/v2/chat/completions execution path resolve saved tool identifiers without repeating that ownership validation, satisfying the conditions for [CWE-863].
Attack Vector
Exploitation requires an authenticated FastGPT account and knowledge or enumeration of a victim's toolset application identifier. The attacker creates a workflow containing an HTTP tool node whose saved tool id points to the victim's http-<victim_toolset_app_id>/<tool_name>. The attacker then triggers the workflow through the standard chat completions endpoint, causing FastGPT to invoke the victim-owned tool. The vulnerability manifests over the network with no user interaction, though attack complexity is elevated because the attacker must obtain the target toolset identifier. See the GitHub Security Advisory GHSA-93r3-wqq3-c5ch for advisory details.
Detection Methods for CVE-2026-61643
Indicators of Compromise
- Workflow node definitions containing saved tool identifiers with the pattern http-<app_id>/<tool_name> where <app_id> does not belong to the workflow owner.
- Requests to /api/v2/chat/completions that trigger HTTP toolset executions attributable to accounts other than the toolset owner.
- Unexpected outbound calls originating from HTTP toolsets belonging to users who did not initiate the invoking workflow.
Detection Strategies
- Audit stored workflow definitions in the FastGPT database and flag any node whose saved tool reference resolves to a toolset owned by a different user or team.
- Correlate chat completions request logs with toolset ownership metadata to surface cross-tenant tool invocations.
- Review application logs for HTTP toolset executions where the invoking workflow owner differs from the toolset owner.
Monitoring Recommendations
- Enable verbose logging on the workflow save endpoint and on /api/v2/chat/completions to capture referenced tool identifiers.
- Track outbound HTTP requests initiated by toolsets and alert on volume or destination anomalies per toolset owner.
- Monitor administrative and user access logs for reconnaissance patterns that enumerate application or toolset identifiers.
How to Mitigate CVE-2026-61643
Immediate Actions Required
- Upgrade FastGPT to version 4.15.0-beta5 or later, which enforces authorization on the workflow save and runtime paths.
- Inventory existing workflows and remove or rewrite any node that references a toolset not owned by the workflow owner.
- Rotate any secrets, API keys, or credentials configured in HTTP toolsets that may have been invoked by unauthorized users.
Patch Information
The issue is fixed in FastGPT 4.15.0-beta5. Download the release from the FastGPT v4.15.0-beta5 GitHub release page. The patch applies the toolset authorization check to both the workflow save operation and the runtime resolution performed by /api/v2/chat/completions.
Workarounds
- Restrict FastGPT accounts to trusted users until the upgrade is applied, since exploitation requires authenticated access.
- Temporarily disable HTTP toolsets that contain sensitive credentials or reach high-impact downstream systems.
- Segment tenants across separate FastGPT deployments where cross-user tool invocation would be unacceptable.
# Verify installed FastGPT version and upgrade via Docker
docker inspect fastgpt --format '{{.Config.Image}}'
docker pull ghcr.io/labring/fastgpt:v4.15.0-beta5
docker compose down && docker compose up -d
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
