FastGPT CVE-2026-42344

The attacker must hold a low-privilege authenticated session in FastGPT (PR:L per CVSS vector) with permission to configure or trigger HTTP-based tool integrations or fetch operations that pass through the isInternalAddress() guard in packages/service/common/system/utils.ts. The attacker must additionally own a domain and control its authoritative DNS server, enabling them to set TTLs as low as 0 and switch A/AAAA records between the validation and fetch phases. Exploitation is limited by: (1) mandatory authenticated account in FastGPT - unauthenticated external users cannot trigger this path; (2) requirement to own and operate a controlled DNS server capable of rapid record switching; (3) inherent timing non-determinism making the race window unreliable and preventing automated mass exploitation (SSVC Automatable: no); and (4) the attack's usefulness being proportional to what internal services the FastGPT server can reach - isolated deployments with no sensitive internal neighbors have reduced blast radius.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N, score 6.3) is internally consistent and accurately models the attack constraints: AC:H reflects the DNS timing requirement and the necessity of controlling an authoritative DNS server; PR:L confirms this is an authenticated attack, not unauthenticated; and S:C signals that exploitation escapes FastGPT's own trust boundary into internal network services. EPSS at 0.03% (8th percentile) shows negligible current exploitation, consistent with SSVC's 'Automatable: no' - the DNS race window makes scripted mass exploitation impractical. SSVC also rates exploitation as 'poc,' confirming exploit code exists, which elevates risk above purely theoretical. The absence of any vendor patch is the primary concern: organizations must rely entirely on compensating controls. The combination of no KEV listing, low EPSS, AC:H, and PR:L places this as a realistic but operationally constrained threat - highest priority for organizations running FastGPT with internet-accessible HTTP tool integrations or in environments where internal metadata services (e.g., AWS IMDS) are reachable from the FastGPT server.

An authenticated FastGPT user configures an HTTP tool integration pointing to an attacker-controlled domain with a near-zero DNS TTL. The attacker's authoritative DNS server initially resolves the domain to a public IP, which passes the isInternalAddress() check; the attacker immediately rotates the record to an internal target (e.g., 192.168.1.1 or the AWS IMDS endpoint 169.254.169.254). When FastGPT re-resolves the hostname for the actual HTTP fetch, it connects to the internal service and returns the response - potentially cloud credentials, internal API data, or sensitive configuration - to the attacker. A proof-of-concept exists per SSVC assessment data.