Technical impact
FastGPT by labring exposes a full HTTP proxy through the /api/core/app/httpTools/runTool endpoint without authentication. Clients can provide a base URL, path, HTTP method, headers, and body, and the server will perform the request and return the response. This design flaw allows anyone who can reach the FastGPT instance to perform server‑side request forgery (SSRF) and potentially access internal services and sensitive data such as API keys. The vulnerability is a combination of a missing authentication requirement (CWE‑306) and an SSRF weakness (CWE‑918).
Affected Systems
All FastGPT releases from labring prior to version 4.14.9.5 are affected. Versions 4.14.9.5 and later include authentication checks that protect the proxy endpoint.
Risk and Exploitability
The CVSS base score of 10 indicates a critical severity, and the EPSS score of less than 1% suggests a low current likelihood of exploitation. However, the attack can be carried out trivially once network access to the exposed endpoint is available, as no credentials are required. The likely attack vector is an unauthenticated HTTP request to the protected endpoint, which then forwards the request to internal services. The vulnerability is not listed in the CISA KEV catalog, meaning publicly documented exploits are not yet known. Nonetheless, the combination of critical score, unauthenticated access, and potential to harvest internal credentials makes this high‑priority for any environment exposing FastGPT externally.
