EUVD-2026-17445Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionNVD
FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy - it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. This issue has been patched in version 4.14.9.5.
AnalysisAI
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbitrary HTTP requests through the server. The /api/core/app/httpTools/runTool endpoint accepts user-controlled URLs, methods, headers, and body parameters without authentication, functioning as an open proxy for network pivoting, credential theft, and internal network reconnaissance. CVSS 10.0 (Critical) with network attack vector and no privileges required. No public exploit identified at time of analysis, though exploitation is trivial given the exposed endpoint design. EPSS data not available.
Technical ContextAI
FastGPT is an open-source AI Agent building platform (cpe:2.3:a:labring:fastgpt) that includes HTTP tool integration for agent workflows. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function) in the HTTP tools testing endpoint. This endpoint was designed to test HTTP-based integrations but lacked authentication controls, allowing any network client to submit arbitrary HTTP requests that the FastGPT server executes on their behalf. The server-side request forgery (SSRF) capability is compounded by full control over destination URL, HTTP method (GET/POST/PUT/DELETE), custom headers (enabling authentication token injection), and request body content. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:C indicates network-accessible exploitation with no complexity barriers, no required privileges, no user interaction, and scope change - meaning attacks can pivot from the FastGPT server to reach otherwise inaccessible systems. The Changed scope reflects the proxy's ability to impact resources beyond the vulnerable component itself, including internal services, cloud metadata endpoints, and third-party APIs.
RemediationAI
Upgrade immediately to FastGPT version 4.14.9.5 or later, released by Labring to address this critical authentication bypass. The patch is available at https://github.com/labring/FastGPT/releases/tag/v4.14.9.5 with the security fix implemented in commit bc7eae2ed61481a5e322208829be291faec58c00 via pull request 6640 (https://github.com/labring/FastGPT/pull/6640). If immediate patching is not feasible, implement network-level controls to restrict access to the /api/core/app/httpTools/runTool endpoint, allowing only authenticated and authorized internal services. Deploy web application firewall (WAF) rules to block unauthenticated requests to paths matching /api/core/app/httpTools/* and monitor logs for suspicious outbound HTTP requests originating from the FastGPT server that may indicate exploitation attempts. Review server access logs for historical abuse of the endpoint, examining for requests to internal IP ranges (RFC 1918), cloud metadata endpoints (169.254.169.254), or unusual external domains. Conduct network segmentation review to limit blast radius if the FastGPT instance was previously exploited as a pivot point.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Server-side request forgery in FastGPT (labring) versions 4.14.11 and prior lets a low-privileged user coerce the server
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attack
Cross-tenant data disclosure in FastGPT 4.14.17 through 4.15.0-beta5 lets a low-privileged tenant user read another tena
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today