CVE-2026-61684: FastGPT Information Disclosure Flaw

CVE-2026-61684 Overview

FastGPT is a knowledge-based AI application platform. CVE-2026-61684 affects the plugin invoke reverse-call endpoints under /api/invoke/* in FastGPT version 4.15.0-beta4. These endpoints authenticate requests solely by verifying a JSON Web Token (JWT) signed with INVOKE_TOKEN_SECRET. The secret defaults to the constant string token and was not set in official deployment templates.

An unauthenticated attacker can self-sign an HS256 JWT and reach /api/invoke/userInfo to disclose cross-tenant user personally identifiable information (PII) using attacker-supplied tmbId values. Attackers can also reach /api/invoke/fileUpload to write attacker-controlled content into chat files. The issue is fixed in version 4.15.0-beta5.

Critical Impact
Unauthenticated attackers can forge JWTs to access cross-tenant user PII and inject arbitrary content into chat file storage across FastGPT deployments.

Affected Products

FastGPT 4.15.0-beta4
FastGPT deployments using default INVOKE_TOKEN_SECRET configuration
Official FastGPT deployment templates prior to 4.15.0-beta5

Discovery Timeline

2026-07-15 - CVE CVE-2026-61684 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61684

Vulnerability Analysis

The vulnerability stems from the use of hardcoded credentials [CWE-798] in the plugin invoke authentication layer. FastGPT exposes reverse-call endpoints under /api/invoke/* intended for internal plugin-to-server communication. These endpoints verify caller identity by validating a JWT signed with INVOKE_TOKEN_SECRET.

In 4.15.0-beta4, this secret defaults to the constant string token when unset. Official deployment templates did not set the variable, leaving production installations relying on the predictable default. Any attacker with knowledge of the default value can forge valid HS256 tokens.

Once a forged JWT is accepted, /api/invoke/userInfo returns user profile data keyed by an attacker-supplied tmbId (team member ID). The /api/invoke/fileUpload endpoint accepts attacker-controlled payloads and writes them into chat file storage, enabling content injection into other tenants' conversations.

Root Cause

The root cause is a hardcoded fallback secret combined with missing configuration enforcement. The service falls back to token when INVOKE_TOKEN_SECRET is undefined and performs no additional authorization checks tying the JWT claims to the caller identity or the requested tmbId.

Attack Vector

Exploitation is network-based, requires no privileges, and no user interaction. An attacker crafts an HS256 JWT signed with token, submits it to /api/invoke/userInfo with arbitrary tmbId values to enumerate PII, or to /api/invoke/fileUpload to plant malicious files.

typescript

// Patch: packages/service/env.ts - require invoke token secret configuration (#7170)
const LogLevelSchema = z.enum(['trace', 'debug', 'info', 'warning', 'error', 'fatal']);
const StorageVendorSchema = z.enum(['minio', 'aws-s3', 'cos', 'oss']);
const StorageCosProtocolSchema = z.enum(['https:', 'http:']);

const TEST_INVOKE_TOKEN_SECRET = 'fastgpt_test_invoke_token_secret_32';

/**
 * 测试套件会在多个 workspace（包含 pro/admin 子模块）里直接导入 serviceEnv。
 * 生产启动仍要求显式配置 INVOKE_TOKEN_SECRET；仅 Vitest/测试环境允许注入稳定测试密钥，
 * 避免每个测试项目都重复维护同一个必填运行时密钥。
 */
const getRuntimeEnv = (): NodeJS.ProcessEnv => ({
  ...process.env,
  INVOKE_TOKEN_SECRET:
    process.env.INVOKE_TOKEN_SECRET ??
    (process.env.VITEST === 'true' || process.env.NODE_ENV === 'test'
      ? TEST_INVOKE_TOKEN_SECRET
      : undefined)
});

export const serviceEnv = createEnv({
  skipValidation: isPhaseProductionBuild,

Source: GitHub Commit f5f1e58

Detection Methods for CVE-2026-61684

Indicators of Compromise

Unexpected HTTP requests to /api/invoke/userInfo or /api/invoke/fileUpload from external or non-plugin IP addresses.
JWT Authorization headers on invoke endpoints signed with the constant string token.
Chat file records containing content that no authenticated user uploaded, or with mismatched tenant ownership.

Detection Strategies

Inspect FastGPT access logs for /api/invoke/* traffic and correlate tmbId request parameters against expected internal callers.
Decode JWTs presented to invoke endpoints and flag tokens verifiable with weak or default secrets such as token.
Alert on enumeration patterns where sequential or high-volume tmbId values are queried against /api/invoke/userInfo.

Monitoring Recommendations

Enable request logging on the FastGPT reverse-proxy and forward logs to a centralized analytics platform for retention and correlation.
Monitor object storage for unexpected writes to chat file paths originating from the invoke pipeline.
Track environment configuration drift to detect missing or default values for INVOKE_TOKEN_SECRET.

How to Mitigate CVE-2026-61684

Immediate Actions Required

Upgrade FastGPT to version 4.15.0-beta5 or later, which enforces explicit configuration of INVOKE_TOKEN_SECRET.
Set INVOKE_TOKEN_SECRET to a cryptographically random value of at least 32 characters in every environment.
Rotate any previously issued invoke tokens and audit /api/invoke/* access logs for suspicious activity.

Patch Information

The fix is available in FastGPT Release v4.15.0-beta5 via Pull Request #7170. Details are documented in GitHub Security Advisory GHSA-w732-rq8c-chc8. The patch removes the default fallback secret and requires operators to provide INVOKE_TOKEN_SECRET at runtime.

Workarounds

Restrict network access to /api/invoke/* endpoints so only trusted plugin services can reach them, using firewall rules or reverse-proxy allow-lists.
Override INVOKE_TOKEN_SECRET with a strong random value in deployment manifests even if remaining on 4.15.0-beta4 temporarily.
Terminate TLS at a gateway that strips unauthorized Authorization headers to invoke paths.

bash

# Configuration example: projects/app/.env.template
FILE_TOKEN_KEY=
# 密钥加密 key
AES256_SECRET_KEY=fastgptsecret
# Invoke 反向调用 JWT 密钥，至少 32 位
INVOKE_TOKEN_SECRET=fastgpt_invoke_token_secret_32_chars_min
# root key（最高权限）
ROOT_KEY=fdafasd