FastGPT’s HTTP‑tool OpenAPI schema importer validates only the top‑level import URL before handing it to SwaggerParser.bundle. The downstream reference resolver fetches $ref URLs without applying FastGPT’s internal‑address guard, which is the sole mechanism intended to block access to private or cloud‑metadata endpoints. An authenticated team member can therefore specify a reference that points to an internal service or metadata server, causing the resolver to retrieve that data and embed it directly in FastGPT’s response. This flaw is a Server‑Side Request Forgery (SSRF) that can expose sensitive internal information to an attacker.

All FastGPT releases from the start of the project up to, but not including, version 4.15.0‑beta4 are affected. The vulnerability is fixed in 4.15.0‑beta4 and later, which restores the internal‑address guard before performing $ref resolution.

The CVSS score of 7.7 categorises the vulnerability as high severity, indicating a substantial threat to confidentiality of internal resources. The EPSS score of less than 1% suggests a low chance of real‑world exploitation as of this analysis, and the issue is not listed in the CISA KEV catalog. Exploitation requires authentication with a team‑member role and the ability to invoke the schema import, limiting the attack surface to privileged insiders or compromised accounts while nevertheless presenting a notable risk of internal data leakage.