Fastgpt CVE-2026-34162

No special conditions — remote unauthenticated exploitation against FastGPT versions prior to 4.14.9.5. The HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without authentication and accepts arbitrary baseUrl, HTTP methods, headers, and body parameters, enabling full SSRF/HTTP proxy abuse.

This represents critical real-world risk despite no confirmed active exploitation. The CVSS 10.0 score accurately reflects severity: the authentication bypass (PR:N) combined with network accessibility (AV:N) and scope change (S:C) creates a full HTTP proxy that attackers can weaponize immediately. Attack complexity is Low (AC:L) because exploitation requires only standard HTTP requests to a publicly documented API endpoint with no authentication. The Changed scope is particularly concerning - attackers can leverage the FastGPT server's network position to access internal resources, cloud metadata services (AWS/Azure/GCP credential theft), or conduct reconnaissance against third-party services while masking their origin IP. High confidentiality and integrity impact (C:H/I:H) reflect potential for data exfiltration and unauthorized modifications through proxied requests. The Authentication Bypass tag confirms this is a complete control failure, not a logic flaw requiring complex conditions. While no public exploit identified at time of analysis, the technical barrier to exploitation is negligible - any attacker who can reach the FastGPT instance can immediately abuse the proxy. The patch availability (v4.14.9.5) and GitHub security advisory indicate vendor acknowledgment and remediation, making this a high-priority patch deployment scenario. Organizations running FastGPT in cloud environments or with access to sensitive internal networks face immediate risk of network pivoting and credential compromise.

An external attacker discovers a FastGPT instance and crafts a POST request to /api/core/app/httpTools/runTool with a baseUrl pointing to the AWS EC2 metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/). The FastGPT server executes this request server-side and returns IAM temporary credentials to the attacker, who then uses these credentials to access the victim's AWS resources, exfiltrate S3 data, or pivot to other cloud services. Alternatively, the attacker targets internal administrative interfaces (http://internal-admin.corp:8080/api/users) unreachable from the public internet, using the FastGPT server as a proxy to enumerate users, modify configurations, or extract sensitive data while obscuring their true source IP.