FastGPT’s MCP tools endpoints allow an authenticated user to provide an arbitrary URL that the server then requests without verifying whether the address points to an internal or private network. This omission permits a Server Side Request Forgery that can be exploited to scan internal infrastructure, access cloud metadata services, or interact with internal databases such as MongoDB and Redis. The attacker could read or modify data, or use the internal access as a stepping stone for further compromise.

The affected product is FastGPT from labring. All releases older than version 4.14.9.5 are vulnerable. The issue affects every deployment of the MCP tools endpoints that does not perform an internal address check, regardless of operating system or hosting environment.

The CVSS base score of 7.7 indicates a high severity. Although no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, authenticated users can exploit the flaw to access internal services, which presents a significant risk to confidentiality and integrity. The attack requires authentication but otherwise has a straightforward execution path through the undeclared URL parameter.