Executive brief
FastGPT is a platform used to build and deploy AI agents. A security flaw in its workflow engine allows attackers to force the server to send unauthorized requests to internal network services, such as private databases or cloud metadata endpoints. This could lead to the exposure of sensitive internal data or unauthorized access to other systems within the company's private network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the `lafModule` workflow node of FastGPT. The `fetchData` function in `packages/service/core/workflow/dispatch/tools/runLaf.ts` uses the axios library to fetch user-controlled URLs. While a `baseURL` is defined, axios ignores it if the `url` parameter is an absolute path. The application fails to validate these URLs against the `isInternalAddress` blocklist, allowing attackers to bypass SSRF protections. An attacker can exploit this to probe internal services (e.g., Minio, Redis, or AWS IMDS) and retrieve responses. The issue is fixed in version 4.14.17.
Affected products
- labring FastGPT < 4.14.17
Timeline
- 2026-04-28: patched: Version 4.14.17 released
- 2026-05-06: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD