CVE-2026-34162 Details

A server-side request forgery (SSRF) vulnerability has been identified in FastGPT, an AI agent building platform, in versions prior to 4.14.9.5. The vulnerability exists in the HTTP tools testing endpoint, which is exposed without authentication. This endpoint functions as a full HTTP proxy, allowing users to send requests to internal services and external destinations, including cloud metadata services. The lack of authentication enables attackers to exploit the endpoint and access sensitive data, such as third-party API keys and internal MongoDB diagnostic information.

Users are advised to update to FastGPT version 4.14.9.5 or later, where this vulnerability has been patched. For those using earlier versions, it is recommended to add authentication middleware to the HTTP tools endpoint, implement SSRF protection by validating 'baseUrl' parameters, change the default AI Proxy ADMIN_KEY to a stronger value, and ensure proper network segmentation to restrict access to internal services.