Technical impact
FastGPT's MCP tools endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) accept a user‑supplied URL and perform an HTTP call from the server without validating that the address is external. The isInternalAddress() check that protects other endpoints is omitted, allowing an attacker to point the request at any host. Because the calls are made from the application server, a malicious actor can reach internal services such as MongoDB, Redis, or cloud metadata endpoints. This behaviour permits scanning of local network topology, credential disclosure, and the potential for further lateral movement, which aligns with CWE‑918.
Affected Systems
FastGPT, published by labring, is vulnerable in all released versions before version 4.14.9.5. The issue affects the MCP tools endpoints of the application and applies to any deployment that exposes these routes, regardless of environment. There are no known variations in other products or modules.
Risk and Exploitability
With a CVSS base score of 7.7, the flaw is considered high severity. The EPSS score below 1% and absence from the CISA KEV catalog suggest a low chance of widespread exploitation at this time. An attacker with valid credentials to the MCP tools endpoints can supply any target URL and trigger internal HTTP requests. The absence of internal address validation makes exploitation trivial once authenticated, enabling network probing and possible data exfiltration.
