FastGPT CVE-2026-61643

Exploitation requires: (1) an authenticated FastGPT account on the target instance (PR:L; unauthenticated access is not possible); (2) knowledge of a target user's private HTTP toolset application ID, which is not directly browsable but must be obtained through enumeration, a secondary information disclosure, or prior legitimate access; (3) ability to save and execute a workflow on /api/v2/chat/completions, which is the standard authenticated user capability. The following conditions LIMIT exploitation: unauthenticated or anonymous users cannot exploit this; single-tenant self-hosted deployments where all users are fully trusted reduce the impact to near zero; the AC:H complexity reflects that toolset app IDs are not publicly enumerable by default. The normal toolset access routes do enforce authorization correctly - only the workflow save and runtime path is deficient.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N, score 5.9) accurately reflects the real-world risk profile. AC:H is the most significant limiting factor: exploitation requires knowing a victim's toolset app ID, which is not directly exposed in the UI and would require enumeration, information disclosure from another channel, or social engineering. PR:L confirms that any authenticated FastGPT user is a potential attacker, widening the threat surface on multi-tenant or SaaS deployments relative to self-hosted single-tenant instances. The I:H rating is justified because executing a victim's HTTP tool can trigger arbitrary outbound HTTP calls (potentially to internal services, webhooks, or third-party APIs) with the victim's credentials or context embedded in the tool definition - an integrity and indirect confidentiality impact even if the attacker cannot read the tool's source. No EPSS score, KEV listing, or public POC was included in the provided data, so real-world exploitation probability cannot be quantified numerically; however, the authenticated-only requirement and AC:H meaningfully reduce the practical population of exploitable targets. This is a genuine priority for multi-tenant FastGPT deployments and lower priority for isolated self-hosted instances with a small trusted user base.

An authenticated attacker on a multi-tenant FastGPT instance discovers a co-tenant's toolset app ID through enumeration or a separate information leak. The attacker crafts a workflow node using the ID http-<victim_app_id>/<tool_name> and saves it, bypassing the authorization check absent from the workflow save path. When the attacker invokes /api/v2/chat/completions to run the workflow, the platform resolves the reference and fires the victim's private HTTP tool - potentially calling the victim's internal APIs, webhooks, or third-party integrations without the victim's knowledge.