FastGPT, an AI agent platform, contains an endpoint that accepts arbitrary URLs without requiring authentication. The internal address check is only active when a configuration flag is true, which is not the default. As a result, an unauthenticated attacker can instruct the server to resolve and communicate with any URL, including internal IP addresses. This SSRF flaw can let an attacker exfiltrate information, access restricted services, or perform internal network reconnaissance.

The vulnerability affects the FastGPT product by labring. Versions prior to 4.14.10.3 are impacted; the issue was addressed in release 4.14.10.3.

The CVSS base score is 5.3, indicating a medium severity risk. No EPSS data is public and the vulnerability is not listed in the CISA KEV catalog, suggesting exploitation is not broadly observed yet. Nonetheless, because authentication is bypassed, any external user can trigger the SSRF endpoint. Attackers need only to send a crafted request to the /api/core/app/mcpTools/runTool URL, and if the flag controlling internal IP checks is left in its default state, the server will resolve the supplied URL without restriction.