FastGPT CVE-2026-84301

Requires an authenticated FastGPT account (PR:L) with access to at least one server-side URL-consuming feature: a safe-Axios-backed HTTP tool, a workflow HTTP node, an external file-fetch integration, or another server-side integration that passes user-supplied URLs through isInternalAddress() in axios.ts. The attacker must additionally control authoritative DNS for the supplied hostname and win a time-of-check/time-of-use race (AC:H) so the name resolves publicly at validation time and to a loopback/private/link-local/metadata (e.g., 169.254.169.254) address at connection time; direct private-address inputs are blocked, so the rebinding window is mandatory. Impact is amplified where the FastGPT server has reachable internal services or cloud instance-metadata endpoints. Limiting factors: authentication requirement, the DNS-rebinding timing race, and the need for attacker-controlled DNS make casual exploitation impractical.

This is a genuine but mid-tier server-side request forgery issue whose real-world risk is moderated by exploitation complexity and required authentication rather than triviality. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N = 6.3) is internally consistent with the description: exploitation is network-reachable but requires an authenticated user (PR:L) who can supply a URL to a safe-Axios-backed integration, and the AC:H rating correctly reflects that a DNS rebinding time-of-check/time-of-use race must be won - the attacker must control an authoritative DNS response so the hostname resolves to a public address during isInternalAddress() validation and to a loopback/private/link-local/metadata address during the subsequent independent connection lookup. The S:C (scope change) and C:H (confidentiality) with I:N/A:N are appropriate: the impact is reading internal-only services or cloud metadata, not modification or denial. No EPSS score, KEV entry, or POC was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - the AC:H rebinding requirement makes opportunistic mass exploitation unlikely and points toward targeted use. Net: a real defense-in-depth SSRF bypass worth patching for internet-exposed or multi-tenant FastGPT deployments, but not an emergency-priority flaw given the authentication gate, race-condition complexity, and absence of confirmed exploitation.

An authenticated FastGPT user configures a workflow HTTP node, HTTP tool, or external file-fetch integration with a hostname on a domain whose DNS the attacker controls, set with a very short TTL. The attacker's DNS server answers with a public IP during FastGPT's isInternalAddress() pre-flight check, then flips to 127.0.0.1 or 169.254.169.254 before the separate outbound connection resolves, causing the server to fetch cloud metadata or internal-only services and return the response to the attacker. No public exploit code was identified, but the technique is well-understood and the same re-resolution weakness also applies to each manual redirect hop.