CVE-2026-34162: FastGPT Auth Bypass Vulnerability

CVE-2026-34162 Overview

CVE-2026-34162 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting FastGPT, an open-source AI Agent building platform. The vulnerability exists in the HTTP tools testing endpoint (/api/core/app/httpTools/runTool), which is exposed without any authentication mechanism. This endpoint functions as a full HTTP proxy, accepting user-supplied parameters including baseUrl, toolPath, HTTP method, custom headers, and body content. The server then makes HTTP requests on behalf of the attacker and returns complete responses, enabling unauthorized access to internal resources and potential data exfiltration.

Critical Impact

Unauthenticated attackers can leverage the FastGPT server as a proxy to access internal network resources, cloud metadata services, and other protected endpoints, potentially leading to full infrastructure compromise.

Affected Products

• FastGPT versions prior to 4.14.9.5
• FastGPT HTTP Tools Testing Endpoint (/api/core/app/httpTools/runTool)
• Self-hosted and cloud-deployed FastGPT instances

Discovery Timeline

• 2026-03-31 - CVE-2026-34162 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34162

Vulnerability Analysis

This vulnerability represents a classic authentication bypass combined with SSRF attack vector. The vulnerable endpoint was designed for testing HTTP tool integrations within FastGPT workflows but was inadvertently exposed without proper access controls. When an attacker sends a crafted request to this endpoint, the FastGPT server processes it and forwards the HTTP request to any arbitrary destination specified by the attacker.

The lack of authentication (CWE-306: Missing Authentication for Critical Function) allows any remote attacker to access this functionality without credentials. Combined with the proxy capability, this creates a powerful attack primitive that can be used to probe internal networks, access cloud metadata services (such as AWS IMDSv1 at 169.254.169.254), interact with internal APIs, and bypass firewall restrictions that would normally block external access.

Root Cause

The root cause of CVE-2026-34162 is the missing authentication mechanism on the /api/core/app/httpTools/runTool endpoint. This API route was implemented to allow developers to test HTTP integrations but was not properly protected behind authentication middleware. The endpoint accepts arbitrary URL destinations and forwards requests without validating the caller's identity or restricting the target URLs to a safe allowlist.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP requests directly to the vulnerable endpoint with malicious parameters. The attack flow involves:

1. The attacker identifies a FastGPT instance exposed to the network
2. A crafted POST request is sent to /api/core/app/httpTools/runTool with a malicious baseUrl pointing to an internal resource
3. The FastGPT server makes the request on behalf of the attacker
4. The complete response from the internal resource is returned to the attacker, including sensitive data, internal API responses, or cloud credentials

This vulnerability is particularly dangerous in cloud environments where attackers can access instance metadata endpoints to retrieve temporary credentials, potentially leading to full cloud infrastructure compromise.

Detection Methods for CVE-2026-34162

Indicators of Compromise

• Unusual outbound HTTP requests from FastGPT servers to internal IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (169.254.169.254) originating from FastGPT application servers
• High volume of requests to /api/core/app/httpTools/runTool from external IP addresses
• Requests containing sensitive internal URLs in the baseUrl or toolPath parameters

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on requests to the vulnerable endpoint pattern
• Enable detailed access logging for FastGPT application servers and analyze for suspicious patterns
• Deploy network monitoring to detect SSRF-style traffic patterns where the FastGPT server makes unexpected outbound connections
• Use SentinelOne Singularity to detect anomalous process behavior and network connections from FastGPT containers or hosts

Monitoring Recommendations

• Configure alerts for any access to /api/core/app/httpTools/runTool from unauthenticated sessions
• Monitor FastGPT server egress traffic for connections to internal network ranges and cloud metadata services
• Implement rate limiting and anomaly detection on the vulnerable endpoint until patching is complete
• Review FastGPT access logs for historical exploitation attempts prior to patching

How to Mitigate CVE-2026-34162

Immediate Actions Required

• Upgrade FastGPT to version 4.14.9.5 or later immediately
• If immediate upgrade is not possible, block external access to /api/core/app/httpTools/runTool at the network or reverse proxy level
• Review FastGPT server logs for any historical exploitation attempts
• Audit any cloud credentials or internal systems that may have been accessed through this vulnerability

Patch Information

FastGPT has addressed this vulnerability in version 4.14.9.5. The fix adds proper authentication checks to the HTTP tools testing endpoint, ensuring only authorized users can access the proxy functionality. The patch was implemented via GitHub Pull Request #6640 and the specific commit can be reviewed at bc7eae2ed61481a5e322208829be291faec58c00. Full details are available in the GitHub Security Advisory GHSA-w36r-f268-pwrj.

Workarounds

• Block access to /api/core/app/httpTools/runTool endpoint at the reverse proxy or load balancer level
• Implement network segmentation to restrict FastGPT server egress traffic to only necessary external services
• Deploy a WAF rule to deny requests matching the vulnerable endpoint pattern from unauthenticated sources
• Consider placing FastGPT behind VPN or zero-trust network access until patching is complete

# Nginx configuration to block the vulnerable endpoint
location /api/core/app/httpTools/runTool {
    deny all;
    return 403;
}