FastGPT’s HTTP‑tool OpenAPI schema importer validates only the top‑level import URL before handing it to SwaggerParser.bundle. The downstream reference resolver fetches $ref URLs without applying FastGPT’s internal‑address guard, which is the sole mechanism intended to block access to private or cloud‑metadata endpoints. An authenticated team member can therefore specify a reference that points to an internal service or metadata server, causing the resolver to retrieve that data and embed it directly in FastGPT’s response. This flaw is a Server‑Side Request Forgery (SSRF) that can expose sensitive internal information to an attacker.

All releases of labring:FastGPT prior to version 4.15.0‑beta4 are affected. The vulnerability is fixed in 4.15.0‑beta4 and later, which restores the internal‑address guard before performing $ref resolution.

The CVSS score of 7.7 categorises the vulnerability as high severity, indicating a substantial threat to confidentiality of internal resources. The EPSS score of less than 1% suggests a low chance of real‑world exploitation as of this analysis, and the issue is not listed in the CISA KEV catalog. Exploitation requires authentication with a team‑member role and the ability to invoke the schema import, limiting the attack surface to privileged insiders or compromised accounts while nevertheless presenting a notable risk of internal data leakage.