FastGPT EUVD-2026-42116

Exploitation requires an authenticated FastGPT team member account (CVSS PR:L) with access to the HTTP-tool feature, and the specific prerequisite that the target instance uses the OpenAPI/Swagger schema importer path that calls SwaggerParser.bundle on user-supplied schemas. The attacker must supply a schema whose top-level URL passes FastGPT's internal-address guard while embedding a $ref that points at the internal target (e.g., cloud metadata at 169.254.169.254 or an internal service), because only the top-level URL is validated. Impact is meaningfully limited by: the required authenticated team-member privilege (no unauthenticated exploitation), the value depending on FastGPT's network position (cloud-hosted instances with reachable metadata endpoints yield the highest impact, isolated on-prem instances far less), and the read-only nature of the flaw (no write/integrity or availability effect).

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N = 7.7 High) is internally consistent with the description: network-reachable, low complexity, requires low privilege (an authenticated team member), no user interaction, scope change (the app reaches systems it should not), and high confidentiality impact with no integrity or availability effect. No EPSS score, KEV entry, or SSVC decision data was provided, and no public exploit is identified, so real-world exploitation pressure appears low-to-moderate rather than urgent. The main risk driver is deployment context: FastGPT instances hosted in cloud environments (AWS/GCP/Azure) expose the 169.254.169.254 metadata endpoint, so a successful read can leak IAM credentials or tokens - turning a bounded info-disclosure into a potential pivot. Because PR:L means an attacker must already be a team member, this is more relevant to multi-tenant or larger-team deployments than to single-operator installs; treat as a real priority where FastGPT runs in cloud with untrusted or numerous team members, and as lower priority for isolated single-user deployments.

An authenticated FastGPT team member creates an HTTP tool and supplies an OpenAPI schema whose top-level URL points to an attacker-controlled host that passes FastGPT's guard, but which contains a $ref pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ or an internal service. When FastGPT bundles the schema, SwaggerParser resolves that $ref without the internal-address guard and returns the cloud IAM credentials or internal response inline to the user. No public proof-of-concept is currently identified, but the low attack complexity makes crafting one straightforward for an authenticated actor.