EUVD-2026-44678Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible redirect abuse requires only authenticated workflow user (PR:L); scope changes (S:C) to internal/metadata systems yield high confidentiality impact (C:H) with no integrity or availability consequence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta5, FastGPT's shared SSRF guard validates only the initial request URL before handing the request to axios, and axios follows redirects by default. An authenticated workflow user can configure an HTTP request node to call an attacker-controlled public URL that redirects to cloud metadata, loopback, or internal services that the guard would block on direct request, and the HTTP node returns the response body to the workflow caller. This issue is fixed in version 4.15.0-beta5.
AnalysisAI
SSRF guard bypass in FastGPT prior to 4.15.0-beta5 enables authenticated workflow users to reach cloud metadata endpoints, loopback interfaces, and internal network services that the guard would otherwise block on direct request. The HTTP request workflow node submits the initial URL to the SSRF guard for validation, but then hands the request to axios, which follows HTTP redirects by default without re-triggering the guard - allowing an attacker-controlled redirect server to pivot the request to any internal target. No public exploit code has been identified at time of analysis, but the technique is well-understood, low-complexity once authenticated, and particularly severe in cloud-hosted deployments where IMDSv1 metadata endpoints expose IAM credentials.
Technical ContextAI
FastGPT is a Node.js-based AI knowledge-base application platform (CPE: cpe:2.3:a:labring:fastgpt:*:*:*:*:*:*:*:*) that exposes a visual workflow builder where users can configure HTTP request nodes to call external services. The platform uses axios as its HTTP client, which follows 3xx redirects transparently by default. The root cause (CWE-918: Server-Side Request Forgery) is a validate-before-execute gap: the SSRF guard inspects only the initial URL supplied by the workflow user, approves it as an external destination, and then passes control to axios, which silently resolves any redirect chain. Because the guard is not re-invoked after redirect resolution, a destination that would fail direct validation - such as 169.254.169.254 (AWS IMDSv1), fc00::/7 ranges, or 127.0.0.1 - becomes reachable. The workflow node returns the full HTTP response body to the caller, completing the exfiltration. The release notes for v4.15.0-beta5 explicitly reference 'optimize SSRF validation after redirect' confirming the design flaw was in the redirect handling path.
RemediationAI
Upgrade FastGPT to version 4.15.0-beta5 or later by updating container images to fastgpt-app:v4.15.0-beta5, fastgpt-pro:v4.15.0-beta5, and fastgpt-plugin:v1.0.0-beta5 as documented at https://github.com/labring/FastGPT/releases/tag/v4.15.0-beta5. If immediate upgrade is not feasible, restrict HTTP request workflow node configuration to fully trusted administrator accounts only, reducing the pool of users who can submit arbitrary URLs. For AWS deployments, enforce IMDSv2 (session-oriented, requiring a PUT-first token exchange) on all EC2 instances and ECS task metadata endpoints - IMDSv1-style single-hop SSRF requests will fail against IMDSv2, substantially reducing cloud credential theft risk, though this does not block SSRF against other internal services. Applying container-level egress network policies to restrict FastGPT outbound HTTP to an allowlist of known external destinations limits SSRF reachability but may break legitimate workflow integrations and requires careful enumeration of needed external endpoints before enforcement.
FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable t
Unauthenticated HTTP proxy abuse in FastGPT (AI Agent platform) prior to v4.14.9.5 allows remote attackers to relay arbi
Remote code execution in FastGPT's agent-sandbox component (versions 4.14.10 through 4.14.12) lets any network-adjacent,
NoSQL injection in FastGPT <4.14.9.5 password authentication allows unauthenticated remote attackers to bypass login con
Channel hijack and denial of service in FastGPT (labring/FastGPT) before 4.15.2 lets an unauthenticated remote attacker
GitHub Actions artifact-poisoning (pwn request) in labring/FastGPT allows an external attacker who opens a pull request
NoSQL injection in FastGPT versions before 4.14.9.5 allows authenticated attackers to bypass password verification on th
FastGPT versions 4.14.8.3 and below contain a critical arbitrary code execution vulnerability in the fastgpt-preview-ima
Authentication bypass in FastGPT 4.15.0-beta4 lets unauthenticated remote attackers forge JWTs and access internal plugi
Cross-tenant file disclosure in FastGPT prior to v4.15.0-beta5 allows an attacker to read another team's stored files by
Server-side request forgery in FastGPT before 4.15.0-beta4 lets an authenticated team member abuse the HTTP-tool OpenAPI
Server-Side Request Forgery in Labring FastGPT prior to 4.15.0-beta1 lets an authenticated attacker bypass the platform'
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today