Executive brief
FastGPT, an AI agent building platform, contained a security flaw where its protection against internal network requests was inconsistently applied. While some parts of the system blocked access to private internal servers, the tool creation process allowed users to save malicious internal addresses. This could allow an authorized user to force the platform to connect to sensitive internal systems, potentially leading to unauthorized data access or disruption of internal services.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability existed in FastGPT due to inconsistent validation of Model Context Protocol (MCP) tool URLs. While direct preview and run endpoints correctly rejected internal/private network URLs, the create and update endpoints for MCP tools failed to perform these checks before persisting the URL to the database. An authenticated attacker with permissions to manage MCP toolsets could store an internal endpoint (e.g., http://localhost:3000). When the backend workflow runner later executed these tools, it would connect to the stored internal destination without re-validation. The vulnerability is addressed in version 4.14.17 by implementing a shared validation helper (assertMCPUrlNotInternal) across both the persistence and execution layers.
Affected products
- labring FastGPT < 4.14.17
Timeline
- 2026-04-28: patched: Fix committed to main branch.
- 2026-05-08: disclosed: CVE published.