CVE-2026-44286 is a Server-Side Request Forgery (SSRF) vulnerability in labring's FastGPT AI Agent building platform. The flaw exists in versions prior to 4.14.17 where the fetchData function in the lafModule workflow node uses axios to fetch URLs controlled by users without validating them against the internal network blocklist guard (isInternalAddress). This allows attackers, including unauthenticated users or authenticated users with app editing privileges, to bypass SSRF protections and send arbitrary HTTP requests to internal or private network addresses. The issue has been addressed and patched in FastGPT version 4.14.17.

An attacker can exploit this vulnerability to make the server send arbitrary HTTP requests to internal or private network resources that are otherwise inaccessible externally. This could potentially expose internal services or data. However, the CVSS score of 2.3 and the low severity rating indicate that the impact is limited, and exploitation requires at least app editing privileges or unauthenticated access to the vulnerable endpoint.

Upgrade FastGPT to version 4.14.17 or later, where the SSRF vulnerability has been patched. No other specific mitigations are indicated. Patch status is confirmed by the vendor advisory stating the issue is fixed in version 4.14.17.