FastGPT
CVE-2026-44284
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Network-accessible endpoints require low-privilege authentication to create MCP tools; SSRF impact is bounded to internal service probing with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
3DescriptionCVE.org
FastGPT is an AI Agent building platform. Prior to version 4.14.17, FastGPT had an inconsistent SSRF protection gap in MCP tool URL handling. The direct MCP preview/run endpoints already rejected internal/private network URLs, but the MCP tool create/update endpoints could still save an internal MCP server URL. That stored URL could later be used by workflow execution without revalidating the destination. An authenticated user with permission to create or manage MCP toolsets could store an internal endpoint such as http://localhost:3000/mcp and later cause the FastGPT backend workflow runner to connect to that internal destination. This issue has been patched in version 4.14.17.
AnalysisAI
Server-Side Request Forgery in FastGPT prior to v4.14.17 allows authenticated users with MCP toolset management permissions to bypass internal network protections by storing private endpoint URLs through the MCP tool create or update API endpoints. The protection gap existed because preview and run endpoints validated URLs against internal address ranges, but the create and update paths did not, meaning a stored URL such as http://localhost:3000/mcp would later be resolved by the backend workflow runner without re-validation. No active exploitation is confirmed (not in CISA KEV); SSVC classifies this as POC-level with partial technical impact and non-automatable exploitation.
Technical ContextAI
FastGPT (CPE: cpe:2.3:a:labring:fastgpt:*:*:*:*:*:*:*:*) is a Node.js-based AI agent orchestration platform that supports Model Context Protocol (MCP) toolsets, allowing users to define external HTTP endpoints that the workflow engine connects to at execution time. The root cause is CWE-918 (Server-Side Request Forgery): the isInternalAddress() utility existed and was applied correctly to the MCP preview (getTools) and run (runTool) endpoints, but was absent from the mcpTools/create and mcpTools/update handlers and from the workflow dispatch paths dispatchTool and dispatchRunTool. The fix in PR #6826 (commit c1c6b9520d976d25ed945b5bc4e0768149e6db69) centralizes the check into a new assertMCPUrlNotInternal() function exported from packages/service/core/app/mcp.ts and injects it at every MCP URL consumption site, including both workflow dispatch files and all API route handlers.
RemediationAI
Upgrade FastGPT to version 4.14.17 or later; the patched release is available at https://github.com/labring/FastGPT/releases/tag/v4.14.17 and the upstream fix commit is c1c6b9520d976d25ed945b5bc4e0768149e6db69 (PR #6826). If immediate upgrade is not feasible, restrict the ability to create or update MCP toolsets to highly trusted administrator accounts only, eliminating the attack surface for standard authenticated users. Additionally, deploying egress filtering on the FastGPT backend host to block connections to RFC 1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), and link-local (169.254.0.0/16) addresses provides a network-layer compensating control; note this may break legitimate internal MCP integrations if any exist. Monitoring outbound HTTP connections from the workflow runner process to internal IP ranges can aid in detecting exploitation attempts prior to patching.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Server-side request forgery in FastGPT (labring) versions 4.14.11 and prior lets a low-privileged user coerce the server
Server-Side Request Forgery (SSRF) in FastGPT's Model Context Protocol (MCP) tools endpoints allows authenticated attack
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today