CVE-2026-44284
SSRF Protection Bypass in FastGPT MCP Tool URLs
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fastgpt | fastgpt | to 4.14.17 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FastGPT, an AI Agent building platform, prior to version 4.14.17. It involves an inconsistent Server-Side Request Forgery (SSRF) protection gap in the MCP tool URL handling. While some endpoints rejected internal or private network URLs, the create and update endpoints for MCP tools could still save internal URLs. An authenticated user with permission to create or manage MCP toolsets could store an internal endpoint URL, such as http://localhost:3000/mcp, which could later be used by the backend workflow runner to connect to that internal destination without revalidating the URL.
How can this vulnerability impact me? :
This vulnerability can allow an authenticated user with certain permissions to cause the FastGPT backend to connect to internal network endpoints that are normally inaccessible. This could lead to unauthorized access to internal services, potential data leakage, or exploitation of internal systems. The CVSS score of 6.3 indicates a medium severity with impacts on confidentiality, integrity, and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade FastGPT to version 4.14.17 or later, where the SSRF protection gap has been patched.
Additionally, restrict permissions so that only trusted authenticated users can create or manage MCP toolsets, minimizing the risk of storing malicious internal URLs.