CVE-2026-61646 Overview
CVE-2026-61646 is a Server-Side Request Forgery (SSRF) vulnerability in FastGPT, a knowledge-based AI application platform. Versions prior to 4.15.0-beta5 validate only the initial request URL before delegating the HTTP call to axios, which follows HTTP redirects by default. An authenticated workflow user can configure an HTTP request node to reach an attacker-controlled public URL that redirects to cloud metadata endpoints, loopback addresses, or internal services. The HTTP node returns the response body to the workflow caller, enabling data exfiltration from otherwise unreachable internal endpoints. The issue is fixed in version 4.15.0-beta5.
Critical Impact
Authenticated users can pivot through the FastGPT workflow engine to read cloud instance metadata and internal HTTP services, exposing credentials and sensitive infrastructure data.
Affected Products
- FastGPT versions prior to 4.15.0-beta5
- Self-hosted FastGPT deployments exposing workflow HTTP request nodes
- FastGPT instances running in cloud environments with accessible metadata services (AWS, Azure, GCP)
Discovery Timeline
- 2026-07-15 - CVE-2026-61646 published to NVD
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-61646
Vulnerability Analysis
FastGPT exposes an HTTP request node within its workflow builder that lets authenticated users configure outbound HTTP calls. Before dispatching the request, a shared SSRF guard inspects the target URL and blocks addresses pointing to loopback interfaces, private ranges, or cloud metadata endpoints. The guard runs once, against the URL supplied by the user.
The request itself is then executed by axios, which follows HTTP 3xx redirects by default without re-invoking the guard. An attacker registers a public host that responds with a Location header pointing at http://169.254.169.254/latest/meta-data/ or an internal service address. The initial URL passes validation, and axios transparently follows the redirect. The response body from the internal destination is returned to the workflow caller, completing the SSRF chain.
Root Cause
The root cause is incomplete URL validation [CWE-918]. The guard treats validation as a one-time check on user input rather than a policy applied to every network hop. Because axios follows redirects by default and the guard is not registered as a redirect interceptor, redirected targets are never re-evaluated against the allowlist or blocklist.
Attack Vector
Exploitation requires an authenticated account with permission to create or edit workflows. The attacker configures an HTTP request node targeting a public URL under their control. That endpoint issues a redirect to a restricted internal resource. The workflow executes, axios follows the redirect, and the response body is exposed to the caller. In cloud deployments, this can reveal IAM credentials from instance metadata, internal admin APIs, or Kubernetes API server responses.
No verified public exploit code is available at this time. See the GitHub Security Advisory GHSA-g969-67mv-2qxq for further technical detail.
Detection Methods for CVE-2026-61646
Indicators of Compromise
- Outbound HTTP requests from FastGPT hosts to 169.254.169.254, metadata.google.internal, or metadata.azure.com following an external redirect
- Workflow HTTP request nodes configured with unfamiliar external domains that return 3xx responses
- Unexpected connections from FastGPT to internal service ports such as 127.0.0.1, 10.0.0.0/8, or 172.16.0.0/12 ranges
Detection Strategies
- Inspect FastGPT application logs for HTTP request node executions that resulted in redirect chains ending at private or link-local addresses
- Correlate egress proxy or firewall logs with FastGPT workflow execution timestamps to identify redirect-based pivots
- Alert on any process on FastGPT hosts issuing requests to cloud metadata IPs, which should never be a legitimate application destination
Monitoring Recommendations
- Enable verbose logging on the HTTP request node, capturing final resolved URL after redirects, not just the input URL
- Monitor authentication events for workflow editors and correlate with newly created or modified HTTP request nodes
- Track version strings reported by FastGPT instances to confirm the patched build is deployed across the fleet
How to Mitigate CVE-2026-61646
Immediate Actions Required
- Upgrade FastGPT to version 4.15.0-beta5 or later, which re-validates URLs on each redirect hop
- Audit existing workflows for HTTP request nodes that reference untrusted external domains and disable them pending review
- Rotate any cloud IAM credentials or API tokens that were accessible to the FastGPT host during the vulnerable window
Patch Information
The fix is included in the FastGPT v4.15.0-beta5 release. The patched SSRF guard is applied to every URL in the redirect chain rather than only the initial request. Refer to the GitHub Security Advisory GHSA-g969-67mv-2qxq for full remediation details.
Workarounds
- Restrict outbound network egress from FastGPT hosts using a firewall or egress proxy that blocks RFC1918, loopback, and link-local destinations
- Enforce IMDSv2 on AWS instances hosting FastGPT to require session tokens for metadata access
- Limit workflow editor privileges to trusted administrators until the patched version is deployed
# Example egress restriction using iptables to block metadata and private ranges
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
