CVE-2026-26075: CSRF in FastGPT AI Agent Platform

The CSRF vulnerability in FastGPT allows an attacker to craft malicious HTTP requests that appear to originate from a legitimate user. If a user is logged into FastGPT and visits a website containing a crafted request, the attacker can potentially execute actions as that user, such as modifying data, creating agents, or performing other administrative tasks. The impact is amplified if the user has elevated privileges within the FastGPT platform. Successful exploitation could lead to unauthorized data manipulation, account takeover, and potentially compromise the integrity of the AI agent building environment.

1. Reserved2026-02-10
2. Published2026-02-12
3. Modified2026-02-13
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-26075 is to upgrade FastGPT to version 4.14.7 or later. This version includes a fix that addresses the underlying CSRF vulnerability. If upgrading immediately is not feasible, consider implementing stricter input validation and output encoding on the server-side to prevent malicious requests from being processed. Additionally, implement CSRF protection mechanisms such as synchronizer tokens or double-submit cookies. Regularly review and update FastGPT's security configuration to ensure best practices are followed.