CVE-2026-34163

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) accept a user-supplied URL parameter and make server-side HTTP requests to it without validating whether the URL points to an internal/private network address. Although the application has a dedicated isInternalAddress() function for SSRF protection (used in other endpoints like the HTTP workflow node), the MCP tools endpoints do not call this function. An authenticated attacker can use these endpoints to scan internal networks, access cloud metadata services, and interact with internal services such as MongoDB and Redis. This issue has been patched in version 4.14.9.5.

• CWE-918

• https://github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00Patch
• https://github.com/labring/FastGPT/pull/6640Issue Tracking, Patch
• https://github.com/labring/FastGPT/releases/tag/v4.14.9.5Product, Release Notes
• https://github.com/labring/FastGPT/security/advisories/GHSA-x9vj-5m4j-9mfvExploit, Mitigation, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34156NocoBase is an AI-powered no-code/low-code platform for buil…9.9
• CVE-2026-34158Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34159llama.cpp is an inference of several LLM models in C/C++. Pr…9.8
• CVE-2026-34160Chamilo LMS is an open-source learning management system. In…8.6
• CVE-2026-34161Chamilo LMS is an open-source learning management system. In…5.4
• CVE-2026-34162FastGPT is an AI Agent building platform. Prior to version 4…10
• CVE-2026-34164Valtimo is an open-source business process automation platfo…4.9
• CVE-2026-34165go-git is an extensible git implementation library written i…5
• CVE-2026-34166LiquidJS is a Shopify / GitHub Pages compatible template eng…5.3
• CVE-2026-34167Coolify is an open-source and self-hostable tool for managin…5
• CVE-2026-34168Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34170Coolify is an open-source and self-hostable tool for managin…4.3