EUVD-2026-17447Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) accept a user-supplied URL parameter and make server-side HTTP requests to it without validating whether the URL points to an internal/private network address. Although the application has a dedicated isInternalAddress() function for SSRF protection (used in other endpoints like the HTTP workflow node), the MCP tools endpoints do not call this function. An authenticated attacker can use these endpoints to scan internal networks, access cloud metadata services, and interact with internal services such as MongoDB and Redis. This issue has been patched in version 4.14.9.5.
AnalysisAI
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attackers to probe internal networks, access cloud metadata services (e.g., AWS/GCP instance credentials), and interact with backend databases like MongoDB and Redis. Affects FastGPT versions prior to 4.14.9.5. The vulnerability has CVSS 7.7 (High) with scope change indicating potential lateral movement to other system components. EPSS data not available; no confirmed active exploitation (not in CISA KEV). Public exploit code exists via GitHub security advisory GHSA-x9vj-5m4j-9mfv with technical details and proof-of-concept guidance.
Technical ContextAI
FastGPT is an open-source AI Agent building platform (labring:fastgpt) that implements Model Context Protocol (MCP) for external tool integration. The vulnerability stems from insufficient input validation in two API endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) that accept user-controlled URL parameters to initiate server-side HTTP requests. While the application implements an isInternalAddress() function for SSRF protection used elsewhere (e.g., HTTP workflow nodes), the MCP tools endpoints bypass this safeguard entirely. This is a classic CWE-918 Server-Side Request Forgery flaw where the application acts as a proxy for attacker-specified requests without validating destination addresses. The scope change (S:C) in the CVSS vector indicates the vulnerable component can impact resources beyond its security scope, enabling attackers to pivot from the application layer to infrastructure components like databases and cloud metadata services at 169.254.169.254.
RemediationAI
Upgrade immediately to FastGPT version 4.14.9.5 or later, released by the vendor with a complete fix for the SSRF vulnerability. The patch implements proper URL validation using the existing isInternalAddress() function in the MCP tools endpoints, as shown in GitHub pull request #6640 (https://github.com/labring/FastGPT/pull/6640) and commit bc7eae2ed61481a5e322208829be291faec58c00 (https://github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00). Download the patched version from the official release at https://github.com/labring/FastGPT/releases/tag/v4.14.9.5. If immediate patching is not possible, implement network-level controls to restrict outbound HTTP requests from the FastGPT application server, block access to cloud metadata IP ranges (169.254.169.254/32, fd00:ec2::254), and enforce strict authentication on all internal services. Review application logs for suspicious MCP tools API usage patterns targeting internal IP ranges.
LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild i
UAF in Redis 8.2.1 via crafted Lua scripts by authenticated users. EPSS 12.4%. Patch available.
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific
Memory Corruption was discovered in the cmsgpack library in the Lua subsystem in Redis before 3.2.12, 4.x before 4.0.10,
Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user
Redis before 2.8.21 and 3.x before 3.0.2 allows remote attackers to execute arbitrary Lua bytecode via the eval command.
A buffer overflow in Redis 3.2.x prior to 3.2.4 causes arbitrary code execution when a crafted command is sent. Rated cr
Code injection in OneUptime monitoring via custom JS monitor using vm module. PoC and patch available.
In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerab
An issue was found in Apache Airflow versions 1.10.10 and below. Rated critical severity (CVSS 9.8), this vulnerability
An Integer Overflow issue was discovered in the struct library in the Lua subsystem in Redis before 3.2.12, 4.x before 4
goanother Another Redis Desktop Manager =<1.6.1 is vulnerable to Cross Site Scripting (XSS) via src/components/Setting.v
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today