CVE-2026-54607: FastGPT Information Disclosure Flaw

CVE-2026-54607 Overview

CVE-2026-54607 is a Server-Side Request Forgery (SSRF) vulnerability in FastGPT, a knowledge-based AI application platform. The flaw exists in the HTTP-tool OpenAPI schema importer in versions prior to 4.15.0-beta4. The importer validates only the top-level URL before handing the schema to SwaggerParser.bundle, whose remote reference resolver fetches $ref URLs without applying FastGPT's internal-address guard. Fetched content is returned inline to the caller. Any authenticated team member can leverage this behavior to read internal services or cloud metadata endpoints.

Critical Impact
An authenticated team member can bypass FastGPT's internal-address guard to retrieve content from internal-only services and cloud instance metadata, exposing credentials and internal APIs.

Affected Products

FastGPT versions prior to 4.15.0-beta4
FastGPT HTTP-tool OpenAPI schema importer component
Deployments relying on SwaggerParser.bundle for remote reference resolution

Discovery Timeline

2026-07-07 - CVE-2026-54607 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54607

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery [CWE-918]. FastGPT's HTTP-tool feature allows authenticated users to import an OpenAPI (Swagger) schema from a remote URL. The importer applies an internal-address guard to the top-level URL supplied by the user. That guard prevents direct requests to loopback, link-local, or private network ranges. However, the importer then passes the schema to SwaggerParser.bundle, which recursively resolves $ref references. These $ref fetches do not traverse FastGPT's guard.

An attacker submits a top-level schema hosted on an attacker-controlled endpoint. That schema contains $ref entries pointing at internal targets such as http://169.254.169.254/latest/meta-data/ or internal HTTP services. SwaggerParser.bundle fetches each referenced URL and inlines the response into the bundled schema. FastGPT then returns the bundled result to the requesting user, leaking response bodies from internal endpoints.

Root Cause

The root cause is inconsistent enforcement of the URL allow-list. Validation is applied only once, at the entry point of the importer. The downstream reference resolver operates on user-controlled content and performs its own network I/O without invoking the same validation callback.

Attack Vector

Exploitation requires network access to the FastGPT API and low-privileged authenticated credentials as a team member. No user interaction is required. The scope changes because the vulnerable component pivots from its own security context into other backend systems reachable on the internal network. See the GitHub Security Advisory GHSA-72hf-5382-2mq9 for the vendor description of the attack path.

No public proof-of-concept exploit code is referenced in the advisory. The vulnerability mechanism is described in prose above; see the GitHub Pull Request and remediation commit for the fix implementation.

Detection Methods for CVE-2026-54607

Indicators of Compromise

Outbound HTTP requests originating from the FastGPT backend to cloud metadata endpoints such as 169.254.169.254, metadata.google.internal, or metadata.azure.com.
Outbound requests from FastGPT to RFC1918 addresses or loopback ranges that do not correspond to expected integrations.
Audit-log entries showing OpenAPI schema imports followed by unusually large bundled schema responses.

Detection Strategies

Monitor FastGPT application logs for HTTP-tool schema import events and correlate with the destination hosts contacted by SwaggerParser.bundle.
Deploy egress network policies that log or block FastGPT pods reaching link-local or private ranges, and alert on any denied attempts.
Inspect stored HTTP-tool definitions for $ref values referencing internal hostnames, IP literals, or non-HTTPS schemes.

Monitoring Recommendations

Enable request-level logging on the FastGPT reverse proxy to capture outbound URLs fetched during schema resolution.
Alert on any FastGPT service account accessing cloud instance metadata service (IMDS) endpoints when IMDSv2 is not enforced.
Track authentication events for team member accounts that create or modify HTTP-tool integrations at unusual times.

How to Mitigate CVE-2026-54607

Immediate Actions Required

Upgrade FastGPT to version 4.15.0-beta4 or later, which contains the fix for the reference-resolver bypass.
Enforce IMDSv2 on cloud instances hosting FastGPT to require session tokens for metadata access.
Restrict egress from FastGPT workloads using network policies that deny link-local, loopback, and private ranges except for explicitly required services.
Review existing HTTP-tool definitions and remove any that reference untrusted or unexpected external schema hosts.

Patch Information

The vulnerability is fixed in FastGPT 4.15.0-beta4. The remediation is delivered in the GitHub Release v4.15.0-beta4 and implemented in the remediation commit. The patch extends URL validation into the reference resolution callback so that every fetched $ref is checked against the internal-address guard before a network request is issued.

Workarounds

Disable the HTTP-tool OpenAPI schema import feature for non-administrator roles until the patched version is deployed.
Place FastGPT behind an egress proxy configured with an allow-list of external hosts required for legitimate schema imports.
Limit team-member account provisioning and audit existing accounts to reduce the population of principals able to invoke the importer.

bash

# Example egress restriction using a Kubernetes NetworkPolicy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: fastgpt-egress-restrict
spec:
  podSelector:
    matchLabels:
      app: fastgpt
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.0.0/16
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16
              - 127.0.0.0/8