EUVD-2026-21507Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitrary URLs without authentication. The internal IP check in isInternalAddress() only blocks private IPs when CHECK_INTERNAL_IP=true, which is not the default. This allows unauthenticated attackers to perform SSRF against internal network resources. This vulnerability is fixed in 4.14.10.3.
AnalysisAI
Server-side request forgery (SSRF) in FastGPT versions prior to 4.14.10.3 allows unauthenticated remote attackers to probe and access internal network resources via the /api/core/app/mcpTools/runTool endpoint, which accepts arbitrary URLs without proper validation. The vulnerability is exploitable by default because the internal IP check is gated behind a disabled configuration flag (CHECK_INTERNAL_IP=false), enabling attackers to bypass network segmentation and potentially discover or interact with backend services, databases, or cloud metadata endpoints.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates a network-accessible, unauthenticated attack with low complexity and confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker discovers or enumerates a FastGPT instance on the internet and sends a POST request to /api/core/app/mcpTools/runTool with a URL parameter pointing to an internal service, such as http://localhost:5432 (PostgreSQL), http://192.168.1.100:6379 (Redis), or http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint). Because CHECK_INTERNAL_IP is not enabled by default and no authentication is required, the FastGPT server processes the request and attempts to establish a connection to the attacker-specified URL. … |
| Remediation | Upgrade FastGPT to version 4.14.10.3 or later, which includes the security fix for URL validation in the mcpTools endpoint. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today