Executive brief
FastGPT, a platform for building AI agents, contains a security flaw that allows authenticated users to bypass internal network protections. By using specially formatted web addresses, an attacker can force the AI system to access sensitive cloud metadata services. This can lead to the theft of administrative credentials, cloud service account tokens, and private configuration data, potentially compromising the entire cloud environment where the platform is hosted.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in FastGPT's `isInternalAddress()` function due to improper validation of cloud metadata endpoints. The function uses a `startsWith()` check against a hardcoded list of URLs (e.g., 'http://169.254.169.254/'), which can be bypassed using at least seven different techniques including explicit port specifications (e.g., :80), IPv6-mapped IPv4 addresses, hexadecimal/decimal IP encoding, and trailing dots. Furthermore, the broader private IP validation is disabled by default because the `CHECK_INTERNAL_IP` environment variable defaults to false. An authenticated attacker can exploit this via HTTP or MCP tool endpoints to retrieve sensitive IAM credentials or instance metadata from the underlying cloud provider (AWS, GCP, etc.). As of the advisory date, no patches are available.
Affected products
- labring FastGPT <= 4.14.11
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE-2026-42345 published to NVD