FastGPT CVE-2026-44284

Exploitation requires an authenticated FastGPT user account with permission to create or update MCP toolsets - not all authenticated users possess this privilege by default, making this a permission-scoped vulnerability. The attacker must complete two sequential steps: first, register a malicious MCP tool with an internal URL via the create or update API endpoint; second, cause a workflow that references that MCP tool to execute, either directly or by inducing another user to trigger it. The vulnerability is not exploitable by unauthenticated users (CVSS PR:L). Limiting factors include: the requirement for specific MCP toolset management permissions, the two-step stored-then-triggered exploitation pattern (SSVC Automatable:no), and the absence of direct code execution - impact is limited to internal network probing and service interaction. Multi-tenant SaaS deployments where untrusted users are granted MCP toolset creation rights represent the highest-risk configuration.

The CVSS 3.1 score of 6.3 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) is well-calibrated for this vulnerability. PR:L correctly reflects that exploitation requires an authenticated account with MCP toolset creation privileges - not all authenticated users qualify. The unchanged scope (S:U) reflects that the SSRF leverages the server's internal network position without breaking into a distinct security principal. EPSS at 0.05% (15th percentile) and SSVC Automatable:no both corroborate low opportunistic exploitation risk; mass scanning or automation is impractical given the authentication and permission prerequisites. SSVC Technical Impact:partial aligns with C:L/I:L/A:L - internal service enumeration and interaction are possible but arbitrary RCE is not directly implied. KEV status is absent, and no confirmed public standalone exploit tool has been identified. Overall, this is a real and exploitable SSRF for environments with untrusted authenticated users (e.g., multi-tenant SaaS deployments of FastGPT), but lower priority for single-tenant or tightly access-controlled deployments.

An authenticated FastGPT user with MCP toolset management permissions registers a new MCP tool pointing to http://169.254.169.254/latest/meta-data/ (cloud instance metadata) or http://localhost:8080/internal-admin. When a workflow referencing that MCP tool executes, the FastGPT backend workflow runner issues an HTTP request to the stored internal URL without re-validating it, returning the response to the attacker and enabling enumeration of internal services or cloud credentials. A POC exploit path exists per SSVC assessment, though no public standalone exploit tool has been confirmed.