What is the CVSS score of CVE-2026-40100?

CVE-2026-40100 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40100?

Yes, a patch is available for CVE-2026-40100. Update the affected software to the latest version immediately.

Fastgpt CVE-2026-40100

EUVD-2026-21507 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-10 GitHub_M

SSRF Fastgpt

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.14.10.3

EUVD ID Assigned

Apr 10, 2026 - 17:15 euvd

EUVD-2026-21507

Analysis Generated

Apr 10, 2026 - 17:15 vuln.today

CVE Published

Apr 10, 2026 - 16:39 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitrary URLs without authentication. The internal IP check in isInternalAddress() only blocks private IPs when CHECK_INTERNAL_IP=true, which is not the default. This allows unauthenticated attackers to perform SSRF against internal network resources. This vulnerability is fixed in 4.14.10.3.

AnalysisAI

Server-side request forgery (SSRF) in FastGPT versions prior to 4.14.10.3 allows unauthenticated remote attackers to probe and access internal network resources via the /api/core/app/mcpTools/runTool endpoint, which accepts arbitrary URLs without proper validation. The vulnerability is exploitable by default because the internal IP check is gated behind a disabled configuration flag (CHECK_INTERNAL_IP=false), enabling attackers to bypass network segmentation and potentially discover or interact with backend services, databases, or cloud metadata endpoints.

Technical ContextAI

FastGPT's mcpTools endpoint is designed to execute remote procedures but implements insufficient server-side request validation. The isInternalAddress() function attempts to filter private IP ranges (RFC 1918 addresses, loopback, link-local) but this check is only enforced when CHECK_INTERNAL_IP environment variable is explicitly set to true-a non-default configuration. This is a classic SSRF vulnerability (CWE-918) where user-controlled URL input is passed to backend HTTP requests without adequate origin validation. The root cause is the reliance on a disabled security feature rather than secure-by-default design. An attacker can craft requests to the /api/core/app/mcpTools/runTool endpoint with URLs pointing to internal services (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata, http://localhost:5432 for databases, or http://192.168.x.x/admin for internal networks), and the server will attempt to fetch and return responses, leaking sensitive information or enabling lateral movement.

RemediationAI

Upgrade FastGPT to version 4.14.10.3 or later, which includes the security fix for URL validation in the mcpTools endpoint. For organizations unable to upgrade immediately, enable the CHECK_INTERNAL_IP environment variable (set CHECK_INTERNAL_IP=true) to activate the internal IP range filtering, though this is a temporary mitigation and not a substitute for patching. Additionally, implement network-level controls by restricting outbound access from FastGPT services to internal networks and cloud metadata endpoints (e.g., 169.254.169.254), and consider placing FastGPT behind a Web Application Firewall (WAF) configured to block requests to suspicious internal IP ranges or loopback addresses. The security advisory is available at https://github.com/labring/FastGPT/security/advisories/GHSA-jrhc-f3j7-f8g4.