CVE-2026-34163
Published: 31 March 2026
Summary
CVE-2026-34163 is a high-severity SSRF (CWE-918) vulnerability in Fastgpt Fastgpt. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as APIs and Models; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of user-supplied URL parameters in MCP tools endpoints to block SSRF requests to internal/private networks.
Enforces information flow control policies preventing unauthorized server-side access to internal services like MongoDB and Redis via unvalidated URLs.
Provides boundary protection mechanisms such as proxies or firewalls to restrict application outbound connections to cloud metadata and internal networks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF vulnerability in public-facing app enables T1190; directly facilitates internal network scanning (T1046), cloud metadata access (T1522), and interaction with internal databases like MongoDB/Redis (T1213.006).
NVD Description
FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) accept a user-supplied URL parameter and make server-side HTTP requests to it without validating whether the URL points to…
more
an internal/private network address. Although the application has a dedicated isInternalAddress() function for SSRF protection (used in other endpoints like the HTTP workflow node), the MCP tools endpoints do not call this function. An authenticated attacker can use these endpoints to scan internal networks, access cloud metadata services, and interact with internal services such as MongoDB and Redis. This issue has been patched in version 4.14.9.5.
Deeper analysisAI
CVE-2026-34163 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting FastGPT, an AI Agent building platform, in versions prior to 4.14.9.5. The issue resides in the MCP (Model Context Protocol) tools endpoints, specifically /api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool, which accept a user-supplied URL parameter and issue server-side HTTP requests to it without validating whether the URL targets an internal or private network address. Although FastGPT includes an isInternalAddress() function for SSRF protection in other components like the HTTP workflow node, these MCP endpoints do not invoke it, enabling unauthorized internal network access. The vulnerability carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
An authenticated attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. By supplying malicious URLs to the affected endpoints, the attacker can scan internal networks, access cloud metadata services, and interact with internal services such as MongoDB and Redis, potentially leading to high confidentiality impacts due to the changed scope.
The vulnerability has been patched in FastGPT version 4.14.9.5. Security practitioners should upgrade to this version or later. Relevant resources include the patch commit at https://github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00, the associated pull request at https://github.com/labring/FastGPT/pull/6640, the release notes at https://github.com/labring/FastGPT/releases/tag/v4.14.9.5, and the GitHub security advisory at https://github.com/labring/FastGPT/security/advisories/GHSA-x9vj-5m4j-9mfv.
As FastGPT is an AI Agent building platform, this SSRF vulnerability highlights risks in AI/ML infrastructure where internal services may handle sensitive model data or configurations. No public reports of real-world exploitation are available at this time.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- APIs and Models
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, mcp, model context protocol, mcp