FastGPT EUVD-2026-44678

Exploitation requires an authenticated FastGPT user account with permission to create or modify HTTP request workflow nodes - anonymous access cannot trigger this vulnerability. The attacker must control a publicly reachable web server capable of issuing HTTP 3xx redirects to the desired internal target. The internal target must be reachable from the FastGPT container's network and must return an HTTP response body (not silently drop the connection). Exploitation is limited by: (1) mandatory authentication - workflow configuration access must be granted; (2) the redirect server must be reachable outbound from the FastGPT host; (3) on AWS, IMDSv2 enforcement prevents credential theft from the metadata endpoint via single-hop SSRF redirects; (4) internal services with IP allowlisting or mutual TLS are not reachable by this technique. The vulnerability does not require any non-default FastGPT configuration - the HTTP request node is a core workflow feature available in standard installations.

The CVSS 4.0 base score of 6.3 (AV:N/AC:L/AT:N/PR:L/UI:N/SC:H/SI:N/SA:N) accurately reflects the attack surface but understates practical impact in cloud deployments. Authentication (PR:L) is the primary limiting factor - exploitation is confined to users who already hold workflow configuration permissions. However, once authenticated, the attack is fully automatable: no user interaction, no race condition, and no elevated privileges within FastGPT itself are required. The SC:H metric captures the critical concern: successful SSRF against an AWS IMDSv1 endpoint yields IAM role credentials that can enable full cloud account compromise, a scope impact disproportionate to the CVSSv4 score. EPSS data is absent from available intelligence, and CISA KEV listing is not confirmed, indicating no observed mass exploitation at time of analysis. The attack is not a zero-day - it was responsibly disclosed and patched. The real-world priority is highest for cloud-hosted FastGPT instances running IMDSv1 (not IMDSv2-only) where workflow access is granted to non-administrator users; on-premises deployments with restricted internal network access face a lower effective risk profile.

An authenticated FastGPT user with workflow access creates an HTTP request node targeting an attacker-controlled server (e.g., attacker.example.com/redirect) that responds with an HTTP 302 redirect to http://169.254.169.254/latest/meta-data/iam/security-credentials/MyRole. The FastGPT SSRF guard approves the initial external URL, axios transparently follows the redirect to the metadata endpoint, and the JSON credential response - containing an AWS AccessKeyId, SecretAccessKey, and SessionToken - is returned in the workflow execution output accessible to the attacker. No public exploit code is required; any redirect-capable web server (nginx, a simple Python HTTP server) is sufficient to stage the attack.