CVE-2026-40100

FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitrary URLs without authentication. The internal IP check in isInternalAddress() only blocks private IPs when CHECK_INTERNAL_IP=true, which is not the default. This allows unauthenticated attackers to perform SSRF against internal network resources. This vulnerability is fixed in 4.14.10.3.

• CWE-918

• https://github.com/labring/FastGPT/security/advisories/GHSA-jrhc-f3j7-f8g4Vendor Advisory

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40094nimiq-blockchain provides persistent block storage for Nimiq…4.3
• CVE-2026-40096immich is a high performance self-hosted photo and video man…5.4
• CVE-2026-40097Step CA is an online certificate authority for secure, autom…3.7
• CVE-2026-40098Magento Long Term Support (LTS) is an unofficial, community-…5.4
• CVE-2026-40099Kirby is an open-source content management system. Kirby's u…6.5
• CVE-2026-4010A vulnerability was found in ThakeeNathees pocketlang up to …3.3
• CVE-2026-40102Plane is an open-source project management tool. In versions…6.5
• CVE-2026-40103Vikunja is an open-source self-hosted task management platfo…5.4
• CVE-2026-40104XWiki Platform is a generic wiki platform offering runtime s…8.2
• CVE-2026-40105XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2026-40106Wazuh is a free and open source platform used for threat pre…7.8
• CVE-2026-40107SiYuan is a personal knowledge management system. Prior to 3…6.5