Medium severity5.3NVD Advisory· Published Apr 10, 2026· Updated Apr 15, 2026
CVE-2026-40100
CVE-2026-40100
Description
FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitrary URLs without authentication. The internal IP check in isInternalAddress() only blocks private IPs when CHECK_INTERNAL_IP=true, which is not the default. This allows unauthenticated attackers to perform SSRF against internal network resources. This vulnerability is fixed in 4.14.10.3.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1- github.com/labring/FastGPT/security/advisories/GHSA-jrhc-f3j7-f8g4nvdVendor Advisory
News mentions
0No linked articles in our index yet.