CVE-2026-84301: FastGPT DNS Rebinding SSRF Vulnerability

CVE-2026-84301 Overview

FastGPT is an open-source large language model (LLM) platform for building AI applications on a knowledge base. CVE-2026-84301 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] rooted in a Time-of-Check/Time-of-Use (TOCTOU) DNS rebinding condition. The safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress() before a later HTTP connection performs an independent DNS lookup. An authenticated attacker can exploit this window to reach loopback, private, link-local, or cloud metadata addresses through server-side HTTP integrations. The issue is fixed in FastGPT 4.15.2.

Critical Impact
An authenticated attacker can bypass SSRF hostname allowlisting to reach internal services and cloud metadata endpoints via DNS rebinding.

Affected Products

FastGPT versions prior to 4.15.2
Safe Axios request interceptor in packages/service/common/api/axios.ts
HTTP workflow nodes, external file fetch, and other safe-Axios-backed server-side integrations

Discovery Timeline

2026-09-22 - CVE-2026-84301 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-84301

Vulnerability Analysis

The vulnerability is a classic TOCTOU DNS rebinding flaw in FastGPT's SSRF protection layer. The safe Axios interceptor resolves the target hostname and calls isInternalAddress() to reject internal, loopback, link-local, and cloud metadata targets. The underlying HTTP client subsequently performs its own independent DNS lookup when establishing the TCP connection. An attacker who controls the authoritative DNS response for a hostname can return a public address during validation and a private address during connection. This bypasses the allowlist and directs the request to internal services.

The same independent re-resolution occurs after manual redirect hops. Each redirect target is checked before a separate connection lookup, giving attackers a second bypass path through 3xx responses.

Root Cause

The check and the use are not bound to the same resolved IP address. isInternalAddress() validates a hostname string, while the HTTP transport re-resolves that hostname independently. Without pinning the resolved IP for the connection, the interceptor cannot guarantee the address actually contacted matches the address it validated.

Attack Vector

Exploitation requires authentication and the ability to supply a URL to a safe-Axios-backed feature such as an HTTP tool, workflow HTTP node, or external file fetch. The attacker hosts a domain served by a rebinding-capable authoritative nameserver with a very low TTL. The first DNS query returns a public IP that passes isInternalAddress(). The second query, issued moments later by the HTTP client, returns 127.0.0.1, an RFC1918 address, 169.254.169.254, or another sensitive internal target. The safe Axios request then connects to that internal endpoint.

text

// Sanitized attack flow (no exploit code)
1. Attacker controls evil.example with two A records via rebinding DNS.
2. Attacker submits URL: http://evil.example/path to a workflow HTTP node.
3. FastGPT resolves evil.example -> 203.0.113.10 (public). isInternalAddress() passes.
4. HTTP client re-resolves evil.example -> 169.254.169.254 (metadata).
5. Request is delivered to the cloud metadata endpoint instead of the validated host.

Detection Methods for CVE-2026-84301

Indicators of Compromise

Outbound DNS queries from FastGPT hosts returning multiple divergent A records for the same hostname within short intervals.
Egress connections from FastGPT to 127.0.0.0/8, RFC1918 ranges, 169.254.169.254, or Kubernetes service CIDRs following user-supplied URL submissions.
Workflow HTTP node executions or external file fetch jobs targeting attacker-controlled domains with very low DNS TTLs.

Detection Strategies

Correlate application logs of URL submissions to safe-Axios-backed features with subsequent DNS resolutions and connection destinations for those hostnames.
Alert on FastGPT process connections to cloud metadata IPs (169.254.169.254, fd00:ec2::254) and loopback addresses.
Flag DNS responses to FastGPT resolvers where the same domain returns both public and private addresses inside a rolling five-minute window.

Monitoring Recommendations

Enable verbose logging in packages/service/common/api/axios.ts for validated hostnames and final connection IPs, and centralize the logs for correlation.
Instrument egress firewall telemetry to record source process, destination IP, and destination classification (public, private, metadata).
Track redirect chains handled by safe Axios to identify hostnames whose intermediate hops resolve inconsistently.

How to Mitigate CVE-2026-84301

Immediate Actions Required

Upgrade FastGPT to version 4.15.2 or later, which pins DNS for safe Axios direct requests as delivered in pull request #7261.
Restrict egress from FastGPT hosts using a network policy that blocks loopback, RFC1918, link-local, and cloud metadata destinations at the firewall or service mesh layer.
Audit workflow definitions and HTTP tool configurations for user-supplied URLs and disable features that are not required.

Patch Information

The fix is available in FastGPT v4.15.2. The upstream commit 0a38565 pins the DNS lookup so the connection uses the same IP that was validated. See the GitHub Security Advisory GHSA-6jwp-qf29-hpj9 for coordinated disclosure details.