FastGPT
CVE-2026-42344
MEDIUM
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
DNS rebinding requires attacker-controlled DNS infrastructure (AC:H) and authenticated FastGPT access (PR:L); scope changes to internal systems (S:C) with data-only disclosure impact (C:H, I:N, A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts is vulnerable to DNS rebinding (TOCTOU - Time-of-Check to Time-of-Use). The function resolves the hostname via dns.resolve4()/dns.resolve6() and checks resolved IPs against private ranges, but the actual HTTP request happens in a separate call with a new DNS resolution, allowing the DNS record to change between validation and fetch. At time of publication, there are no publicly available patches.
AnalysisAI
DNS rebinding in FastGPT's isInternalAddress() function enables authenticated low-privilege attackers to perform server-side request forgery (SSRF) against internal network resources by exploiting a TOCTOU race between hostname validation and the actual HTTP fetch. All versions through 4.14.11 are affected, no vendor patch exists at time of publication, and SSVC data confirms a proof-of-concept exists, though EPSS at 0.03% (8th percentile) reflects negligible current exploitation activity. The Scope:Changed CVSS metric confirms that successful exploitation reaches beyond FastGPT itself into adjacent internal services.
Technical ContextAI
FastGPT is an open-source AI Agent building platform by labring (CPE: cpe:2.3:a:labring:fastgpt:*:*:*:*:*:*:*:*) that supports configurable HTTP-based tool integrations. The vulnerable function isInternalAddress() in packages/service/common/system/utils.ts uses Node.js dns.resolve4() and dns.resolve6() to resolve a user-supplied hostname, checks the returned IPs against private/RFC-1918 address ranges, and then issues the actual HTTP fetch in a separate call that triggers a fresh DNS resolution. This is a textbook CWE-367 (Time-of-Check Time-of-Use Race Condition) applied to DNS: because the guard and the fetch are decoupled resolution events, an attacker who controls an authoritative DNS server can serve a public IP during the check phase, then immediately flip the record to an internal address (e.g., 192.168.x.x, 169.254.169.254) for the fetch phase, bypassing the private-range guard entirely. DNS TTLs as low as 0 seconds make the timing window achievable.
RemediationAI
No vendor-released patch has been identified at time of analysis - the advisory explicitly states no publicly available fix exists for versions 4.14.11 and prior. Organizations should monitor https://github.com/labring/FastGPT/security/advisories/GHSA-cc8x-jrqv-hmwh for patch releases. As compensating controls: implement network-level egress filtering on the FastGPT server host to block all outbound connections to RFC-1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local addresses (169.254.0.0/16) at the firewall or OS level - this compensates for the application-layer bypass and is the most effective single control, though it may break legitimate internal integrations. Restrict the FastGPT 'HTTP tool integration' or equivalent fetch features to users with elevated trust levels to reduce the PR:L attack surface. Consider deploying FastGPT in a network segment with no direct route to sensitive internal services such as cloud instance metadata endpoints. None of these controls fix the underlying TOCTOU flaw and should be treated as temporary mitigations pending a vendor patch.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Server-side request forgery in FastGPT (labring) versions 4.14.11 and prior lets a low-privileged user coerce the server
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attack
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today