SEPTEMBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-50562

CRITICAL · CVSS 9.3 EPSS 0.15% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-15 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

The vulnerability affects FastGPT, allowing privileged workflow_run jobs to download artifacts built from untrusted pull request code, which can lead to the deployment of attacker-controlled Docker images. This could result in unauthorized access to sensitive information, including secrets like KUBE_CONFIG_CN, potentially compromising the integrity of the deployment environment. Organizations using GitHub and Docker should prioritize addressing this issue to mitigate risks associated with untrusted code execution and secret exposure.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-50562
Severity
CRITICAL
CVSS
9.3
EPSS
0.15%
GitHub Docker

Original NVD Description

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged workflow_run jobs in .github/workflows/preview-docs-push.yml and .github/workflows/preview-fastgpt-push.yml, allowing attacker-controlled Docker images from the document/ tree or FastGPT build context to be pushed to GHCR and, for documentation previews, deployed with secrets.KUBE_CONFIG_CN.