Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

FastGPT can push attacker-controlled Docker images

CVE-2026-50562 · published 3 months ago
Summary

FastGPT's preview build process can take code from untrusted pull requests and turn it into Docker images that are then uploaded to the container registry and deployed. This could let an attacker run their own code with your deployment credentials. Update the workflow files to restrict where images are built and pushed, or apply the latest safe configuration from the project.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
labring fastgpt <= 22ebfacbb43311e9b73294040ae0eb87390c6bba
Original advisory text
FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows
FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged workflow_run jobs in .github/workflows/preview-docs-push.yml and .github/workflows/preview-fastgpt-push.yml, allowing attacker-controlled Docker images from the document/ tree or FastGPT build context to be pushed to GHCR and, for documentation previews, deployed with secrets.KUBE_CONFIG_CN.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-266Incorrect Privilege Assignment
CWE-494Download of Code Without Integrity Check
CWE-829Inclusion of Functionality from Untrusted Control Sphere
Timeline
Published15 Jul 2026
Updated29 Oct 2026
First seen15 Jul 2026
Sources
CVE-2026-50562 · NVD
CVE-2026-50562 · MITRE
CVE-2026-50562 · OSV
GHSA-rvgc-2c29-g876 · GHSA
Track software like this
Free during beta