CVE-2026-34162: FastGPT Auth Bypass Vulnerability

CVE-2026-34162 Overview

CVE-2026-34162 is a missing authentication vulnerability [CWE-306] in FastGPT, an AI Agent building platform developed by labring. Versions prior to 4.14.9.5 expose the HTTP tools testing endpoint /api/core/app/httpTools/runTool without any authentication. The endpoint functions as a full server-side HTTP proxy that accepts an attacker-supplied baseUrl, toolPath, HTTP method, custom headers, and request body. It then performs the request from the FastGPT server and returns the complete response. The maintainers patched the issue in version 4.14.9.5.

Critical Impact

Unauthenticated attackers can use the FastGPT server as an arbitrary HTTP proxy, enabling server-side request forgery (SSRF) against internal services, cloud metadata endpoints, and other reachable systems.

Affected Products

• FastGPT (labring/FastGPT) versions prior to 4.14.9.5
• Self-hosted FastGPT deployments exposing the HTTP tools API
• Containerized FastGPT instances reachable from untrusted networks

Discovery Timeline

• 2026-03-31 - CVE-2026-34162 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34162

Vulnerability Analysis

FastGPT exposes the route /api/core/app/httpTools/runTool to allow operators to test outbound HTTP tool integrations. The handler reads request parameters that include a destination baseUrl, a toolPath, an HTTP method, arbitrary headers, and a request body. The server then issues the corresponding HTTP request and returns the upstream response to the caller verbatim.

The route does not enforce session, token, or role checks before performing the outbound request. Any remote client able to reach the FastGPT API can invoke the proxy. Because the destination is fully attacker-controlled, the endpoint behaves as an open server-side request forgery primitive rather than a constrained tool tester.

Root Cause

The root cause is missing authentication on a privileged administrative endpoint [CWE-306]. The handler was designed for authenticated tool-builder workflows but was registered on the public API surface without an auth middleware. The patch in version 4.14.9.5, introduced in commit bc7eae2ed61481a5e322208829be291faec58c00 and pull request #6640, adds an authentication requirement to the route.

Attack Vector

An unauthenticated remote attacker sends a POST request to /api/core/app/httpTools/runTool with a JSON body specifying baseUrl, toolPath, method, headers, and body. The FastGPT server performs the request from its own network position and returns the response. Attackers can target internal services such as Kubernetes APIs, Redis, Elasticsearch, internal admin panels, or cloud instance metadata services (for example http://169.254.169.254/) to retrieve credentials and IAM tokens. Attackers can also relay arbitrary HTTP traffic through the host to obscure their origin.

No verified public exploit code is currently published. See the GitHub Security Advisory GHSA-w36r-f268-pwrj and the patch commit for technical details.

Detection Methods for CVE-2026-34162

Indicators of Compromise

• Unauthenticated POST requests to /api/core/app/httpTools/runTool in FastGPT access logs.
• Outbound HTTP requests from the FastGPT server to 169.254.169.254, 127.0.0.1, localhost, or RFC1918 ranges that do not match normal tool configurations.
• Request bodies containing attacker-controlled baseUrl values pointing at internal infrastructure or cloud metadata services.
• Large or anomalous response sizes returned from the runTool endpoint to external clients.

Detection Strategies

• Alert on any access to /api/core/app/httpTools/runTool originating from clients without a valid authenticated session.
• Correlate inbound API requests with subsequent outbound HTTP egress from the FastGPT host to identify proxying behavior.
• Inspect web application firewall logs for baseUrl parameters containing private IP ranges, link-local addresses, or cloud metadata hostnames.

Monitoring Recommendations

• Forward FastGPT application and reverse-proxy logs to a centralized log platform for retention and search.
• Monitor egress traffic from FastGPT hosts and baseline expected destinations so deviations trigger alerts.
• Track FastGPT version inventory and flag any host running a release earlier than 4.14.9.5.

How to Mitigate CVE-2026-34162

Immediate Actions Required

• Upgrade FastGPT to version 4.14.9.5 or later, available at the v4.14.9.5 release page.
• Restrict network access to the FastGPT API so it is not reachable from untrusted networks until patching is complete.
• Rotate any cloud IAM credentials, API tokens, or service account secrets accessible from the FastGPT host if exploitation is suspected.
• Review FastGPT access and egress logs for prior abuse of the /api/core/app/httpTools/runTool endpoint.

Patch Information

The vulnerability is fixed in FastGPT version 4.14.9.5. The fix is implemented in commit bc7eae2ed61481a5e322208829be291faec58c00 and merged via pull request #6640. Refer to the GHSA-w36r-f268-pwrj advisory for vendor guidance.

Workarounds

• Block external access to /api/core/app/httpTools/runTool at a reverse proxy or web application firewall until the upgrade is applied.
• Place FastGPT behind an authenticating gateway that requires a valid session cookie or API key for all /api/core/* routes.
• Apply egress filtering on the FastGPT host to deny outbound traffic to cloud metadata addresses such as 169.254.169.254 and to internal management networks.

# Example NGINX configuration to block the vulnerable endpoint until patched
location = /api/core/app/httpTools/runTool {
    return 403;
}