Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2026-34163 is a high-severity SSRF (CWE-918) vulnerability in Fastgpt Fastgpt. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34163 is a server-side request forgery (SSRF) vulnerability, classified under CWE-918, affecting FastGPT, an AI Agent building platform, in versions prior to 4.14.9.5. The issue resides in the MCP (Model Context Protocol) tools endpoints, specifically /api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool, which accept a user-supplied URL parameter and issue server-side HTTP requests to it without validating whether the URL targets an internal or private network address. Although FastGPT includes an isInternalAddress() function for SSRF protection in other components like the HTTP workflow node, these MCP endpoints do not invoke it, enabling unauthorized internal network access. The vulnerability carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
An authenticated attacker with low privileges can exploit this vulnerability over the network with low complexity and no user interaction required. By supplying malicious URLs to the affected endpoints, the attacker can scan internal networks, access cloud metadata services, and interact with internal services such as MongoDB and Redis, potentially leading to high confidentiality impacts due to the changed scope.
The vulnerability has been patched in FastGPT version 4.14.9.5. Security practitioners should upgrade to this version or later. Relevant resources include the patch commit at https://github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00, the associated pull request at https://github.com/labring/FastGPT/pull/6640, the release notes at https://github.com/labring/FastGPT/releases/tag/v4.14.9.5, and the GitHub security advisory at https://github.com/labring/FastGPT/security/advisories/GHSA-x9vj-5m4j-9mfv.
As FastGPT is an AI Agent building platform, this SSRF vulnerability highlights risks in AI/ML infrastructure where internal services may handle sensitive model data or configurations. No public reports of real-world exploitation are available at this time.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17447
Vulnerability Data
FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) accept a user-supplied URL parameter and make server-side HTTP requests to it without validating whether the URL points to…
more
an internal/private network address. Although the application has a dedicated isInternalAddress() function for SSRF protection (used in other endpoints like the HTTP workflow node), the MCP tools endpoints do not call this function. An authenticated attacker can use these endpoints to scan internal networks, access cloud metadata services, and interact with internal services such as MongoDB and Redis. This issue has been patched in version 4.14.9.5.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: ai, mcp, model context protocol
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.6V1.5.3V5.3.2V10.4.7
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.
Input validation directly stops untrusted URLs from being accepted and fetched without destination checks.
Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly include input validation and destination allow-listing that prevent SSRF.
Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.
Vulnerability identification processes can discover and record SSRF flaws in web applications.
Network segmentation and egress controls can limit the damage from successful SSRF requests.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.