PT-2026-31992 · Fastgpt · Fastgpt

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-40100

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.14.10.3

Description FastGPT, an AI Agent building platform, allows unauthenticated attackers to perform Server-Side Request Forgery (SSRF) against internal network resources. The /api/core/app/mcpTools/runTool endpoint accepts arbitrary URLs without authentication. The isInternalAddress() function's internal IP check only functions when CHECK INTERNAL IP is set to true, which is not the default configuration.

Recommendations Update to version 4.14.10.3 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-40100

Affected Products

Fastgpt

References · 3

• https://github.com/labring/FastGPT/security/advisories/GHSA-jrhc-f3j7-f8g4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40100 · Security Note
• https://twitter.com/CVEnew/status/2042710227636596745 · Twitter Post