External risk intelligence

FastGPT WeChat Share Channel Vulnerability Allows Bot Hijacking

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-68929

The vulnerability exists in WeChat share-channel endpoints of an LLM platform designed for public-facing AI applications. These endpoints are intended to be internet-accessible to support public chats, iframes, and embeds, making them directly reachable by unauthenticated users over the public internet in standard deployment configurations.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in FastGPT, an open-source platform for building AI applications. The issue affects the WeChat share-channel endpoints, allowing unauthenticated attackers to potentially disable a team's AI bot or hijack its chat channel by exploiting a lack of proper authorization. This could expose private AI responses and disrupt service.

Unauthenticated access allows hijacking AI chat channels.
This could expose sensitive data and disrupt AI services.
Confirming relevance and exposure is the primary leadership concern.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target a FastGPT team's WeChat bot by knowing its public share ID, which is easily discoverable. The attacker can then hijack the channel, take the bot offline, or reroute its communications to their own bot. This allows them to intercept private responses, disrupt service, and consume the victim's resources.

No authentication required.
Triggered by manipulating share endpoints.
Risk of bot hijacking and data interception.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated attacker could hijack a team's WeChat bot, potentially exposing private responses and consuming victim resources, by exploiting a lack of authentication on WeChat share-channel endpoints.

Team's WeChat bot offline.
Hijack channel via QR code scan.
Private responses may be exposed.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this vulnerability likely falls to the platform or application owners responsible for FastGPT deployments. The first practical step is to inventory all FastGPT instances, confirm their internet reachability, and identify the specific team or owner accountable for each instance before planning remediation.

Identify FastGPT application owners.
Verify internet-exposed share IDs.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FastGPT?

FastGPT is an open-source platform that enables users to create AI applications powered by Large Language Models. It is commonly used to build knowledge-based chatbots that can be integrated into various communication channels, allowing organizations to provide automated, AI-driven responses to user inquiries within their own digital environments.

What does CWE-306 and CWE-862 mean for CVE-2026-68929?

These codes identify a lack of authentication and authorization. In this CVE, the software fails to verify who is making a request or if they have permission to perform an action. Because the system trusts incoming requests to specific endpoints without checking identities, an attacker can manipulate or hijack the communication channel assigned to a particular AI application.

How can an attacker trigger this vulnerability?

An attacker needs only the public shareId, which is intentionally visible in shared links or embedded iframes, to interact with the vulnerable endpoints. The flaw is not triggered by complex technical exploits, but simply by sending requests to the share-channel endpoints. It does not require any internal access or special privileges, making it accessible to anyone who can reach the web service.

Is my FastGPT instance at risk?

Halo Surface Signal indicates that this issue is very likely to impact your systems if you use the WeChat share-channel feature. Because these components are designed to be internet-facing to support public chat interfaces and embeds, they are typically reachable by anyone on the public internet, leaving them exposed to this unauthenticated interference.

What is the first step to fix this?

If you are running a version of FastGPT prior to 4.15.2, your immediate priority is to update to version 4.15.2 or later, as this release includes the necessary security fixes. Before applying the update, verify which of your applications are utilizing the WeChat share-channel feature and identify the teams responsible for those deployments to ensure all instances are accounted for.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.