FastGPT’s shared SSRF guard only validates the initial request URL, allowing an authenticated user to configure a workflow HTTP node to point to a public URL that redirects to internal resources such as cloud metadata, localhost, or private services. The redirect is followed by axios, which returns the response body to the workflow caller. This flaw permits a malicious or compromised user to harvest sensitive internal data or execute unintended internal requests, representing a moderate severity data exposure risk.

The vulnerability affects the FastGPT platform by labring. All versions released before v4.15.0-beta5 are impacted; the issue was corrected in that release.

The CVSS score of 6.3 indicates a medium severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated workflow user and depends on the attacker’s ability to craft redirect chains, so the attack vector is likely remote network with moderate privilege prerequisites.