CVE-2026-34162

Katalog CVE

CVSS 10.0 · Critical EPSS 0,62%

Kerentanan Missing Authentication for Critical Function pada fastgpt. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. This issue has been patched in version 4.14.9.5.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,62% peluang dieksploitasi; lebih tinggi dari 48,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/labring/FastGPT/security/advisories/GHSA-w36r-f268-pwrj exploit · mitigasi · advisory vendor
• https://github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00 patch
• https://github.com/labring/FastGPT/pull/6640 issue tracking · patch
• https://github.com/labring/FastGPT/releases/tag/v4.14.9.5 product · release notes