CVE-2026-34162: SSRF in FastGPT AI Agent Platform

The exposed /api/core/app/httpTools/runTool endpoint in FastGPT allows attackers to specify a baseUrl, toolPath, HTTP method, custom headers, and a request body. Because this endpoint functions as a full HTTP proxy without authentication, an attacker can craft malicious requests to target internal services that are not directly accessible from the outside. This could include accessing internal APIs, databases, or other sensitive resources. Successful exploitation could lead to data breaches, unauthorized access to internal systems, and potentially even remote code execution if the targeted internal service is vulnerable. The lack of authentication significantly broadens the attack surface.

1. Reserved2026-03-25
2. Published2026-03-31
3. EPSS updated2026-04-08

The primary mitigation for CVE-2026-34162 is to immediately upgrade FastGPT to version 4.14.9.5 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or reverse proxy to filter incoming requests to the /api/core/app/httpTools/runTool endpoint. Configure the WAF to block requests with suspicious baseUrl values or those originating from untrusted sources. Additionally, restrict network access to the FastGPT server to only allow necessary connections, limiting the potential blast radius of a successful SSRF attack. After upgrading, confirm the fix by attempting to access an internal resource through the HTTP tools testing endpoint; the request should be denied.