What is the CVSS score of CVE-2026-42345?

CVE-2026-42345 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of FastGPT are affected by CVE-2026-42345?

FastGPT deployments running version 4.14.11 and earlier are vulnerable to server-side request forgery, allowing low-privileged users to extract cloud credentials and secrets from metadata endpoints.

How to fix or mitigate CVE-2026-42345?

Within 24 hours: inventory all FastGPT instances and identify those running version 4.14.11 or earlier, prioritizing cloud-deployed instances. Within 7 days: enable the CHECK_INTERNAL_IP configuration setting to 'true' on all affected deployments, and implement firewall or WAF rules blocking outbound access to 169.254.169.254 and similar cloud metadata endpoints. Within 30 days: establish a process to monitor vendor advisories for patch availability and prepare an upgrade plan to apply patches immediately upon release; simultaneously audit application logs for any exploitation attempts using URL-encoded request patterns.

FastGPT CVE-2026-42345

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-08 GitHub_M

SSRF Fastgpt

7.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Authenticated user (PR:L) triggers a low-complexity network SSRF; scope changes to the metadata service (S:C) yielding credential disclosure (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 22:38 vuln.today

CVE Published

May 08, 2026 - 22:11 nvd

HIGH 7.7

DescriptionCVE.org

FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith() check against a hardcoded list. This check can be bypassed using at least 7 different URL encoding techniques, all of which resolve to the same cloud metadata service but do not match the blocklist patterns. Additionally, the broader private IP check (isInternalIPv4/isInternalIPv6) is disabled by default because CHECK_INTERNAL_IP defaults to false (not 'true'), so these bypasses reach the metadata endpoint without any further validation. At time of publication, there are no publicly available patches.

AnalysisAI

Server-side request forgery in FastGPT (labring) versions 4.14.11 and prior lets a low-privileged user coerce the server into reaching cloud metadata endpoints by defeating the isInternalAddress() blocklist with URL-encoding tricks. The check relies on a fragile fullUrl.startsWith() comparison that at least 7 encoding variants evade, and the deeper private-IP guard is off by default (CHECK_INTERNAL_IP is not 'true'), so requests reach 169.254.169.254-style services unfiltered. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and no vendor patch is yet available.

Technical ContextAI

FastGPT is a TypeScript/Node.js AI-agent building platform that fetches user-supplied URLs (e.g., for knowledge ingestion, web reading, or webhook-style features). The vulnerable control is isInternalAddress() in packages/service/common/system/utils.ts, which is meant to stop SSRF (CWE-918, Server-Side Request Forgery) by rejecting known-dangerous hosts. Instead of resolving and normalizing the target, it does a literal fullUrl.startsWith() match against a hardcoded blocklist of metadata endpoints - a string-prefix approach that ignores URL encoding, alternate host representations, and canonicalization. Because the same metadata IP can be expressed in many encodings that all resolve identically at the network layer but differ as raw strings, the prefix match is trivially bypassed. The secondary defense (isInternalIPv4/isInternalIPv6) that would block RFC1918 and link-local ranges is gated behind the CHECK_INTERNAL_IP environment flag, which defaults to false, leaving the encoding-bypass path with no downstream validation. The affected package per CPE is cpe:2.3:a:labring:fastgpt.

RemediationAI

No vendor-released patch identified at time of analysis (the advisory states no public patches exist yet), so apply compensating controls and monitor GHSA-jhqw-944x-xh94 (https://github.com/labring/FastGPT/security/advisories/GHSA-jhqw-944x-xh94) for a fixed release. As the most direct mitigation, set the CHECK_INTERNAL_IP environment variable to the string 'true' to enable the isInternalIPv4/isInternalIPv6 private/link-local blocking path - trade-off: this can break legitimate internal integrations that intentionally call private hosts, so inventory those first. At the network layer, block egress from the FastGPT server to 169.254.169.254 (and IPv6 fd00:ec2::254) and to RFC1918 ranges, or enforce IMDSv2 with a hop limit of 1 on AWS to neutralize credential theft even if the request reaches metadata - trade-off: egress filtering may disrupt features that fetch internal resources. Where feasible, front outbound fetches with an allowlist proxy that resolves and validates the final IP after decoding. Restrict who can submit fetch/URL-ingestion actions since exploitation requires an authenticated (PR:L) account. Do not rely on the current isInternalAddress() startsWith() blocklist, as it is the defeated control.