Critical severity10.0NVD Advisory· Published Mar 31, 2026· Updated Apr 1, 2026
CVE-2026-34162
CVE-2026-34162
Description
FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. This issue has been patched in version 4.14.9.5.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00nvdPatch
- github.com/labring/FastGPT/pull/6640nvdIssue TrackingPatch
- github.com/labring/FastGPT/security/advisories/GHSA-w36r-f268-pwrjnvdExploitMitigationVendor Advisory
- github.com/labring/FastGPT/releases/tag/v4.14.9.5nvdProductRelease Notes
News mentions
0No linked articles in our index yet.