FastGPT CVE-2026-42345

Exploitation requires: (1) an authenticated FastGPT account with access to a feature that fetches a user-supplied URL (PR:L), (2) the target FastGPT instance running version 4.14.11 or earlier, and (3) the deployment sitting in an environment that actually exposes a reachable cloud metadata endpoint (e.g., AWS/GCP/Azure IMDS) for the SSRF to have high value. The specific bypass condition is that the isInternalAddress() guard uses a fullUrl.startsWith() prefix match, which is evaded by at least 7 URL-encoding representations of the metadata address; the reason no further check stops it is that CHECK_INTERNAL_IP defaults to false ('not true'), disabling isInternalIPv4/isInternalIPv6. Limiting factors that reduce real-world risk: authentication is needed (not unauthenticated), impact is largely confined to information disclosure (I:N/A:N), and operators who have explicitly set CHECK_INTERNAL_IP='true' or who run without any metadata service are substantially protected.

The provided CVSS is 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N): network-reachable, low complexity, requires low privileges, changed scope, high confidentiality impact, no integrity or availability impact - consistent with SSRF that reads cloud metadata (e.g., IAM credentials) but does not directly alter data. Real-world signals temper this: EPSS is 0.03% (8th percentile) and SSVC records Exploitation=none, Automatable=no, Technical Impact=partial, and there is no KEV listing and no POC referenced. These lower-tier signals align with each other and suggest this is a credible but not currently mass-exploited issue - a targeted, opportunity-dependent risk rather than a wormable one. One consistency note: PR:L is appropriate because reaching the URL-fetching feature generally requires an authenticated FastGPT user, and the 'no further validation by default' condition materially raises practical exploitability relative to the modest EPSS. The scope-change/confidentiality-high rating is justified primarily where FastGPT runs in a cloud environment (AWS/GCP/Azure/etc.) that actually exposes a metadata service; on-prem or metadata-less deployments see substantially reduced impact.

An authenticated low-privileged FastGPT user submits a URL to a fetch/ingestion feature that points at the cloud metadata service but is wrapped in one of the several URL-encoding variants that slip past the startsWith() blocklist. FastGPT's server issues the request, and because CHECK_INTERNAL_IP defaults to false there is no private-IP fallback check, so the response - potentially including temporary IAM credentials - is returned to or usable by the attacker. No POC is publicly referenced, but the technique (encoded metadata SSRF) is well understood and low-complexity.