CVE-2026-34162 - Vulnerability Analysis

Overview

FastGPT < 4.14.9.5 contains an authentication bypass caused by an exposed HTTP tools testing endpoint (/api/core/app/httpTools/runTool) acting as a full HTTP proxy, letting remote attackers make arbitrary server-side HTTP requests, exploit requires no authentication.

Severity & Score

Impact

Remote attackers can make arbitrary server-side HTTP requests, potentially accessing internal services or sensitive data.

Mitigation

Upgrade to version 4.14.9.5 or later.

References

• https://github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00
• https://github.com/labring/FastGPT/pull/6640
• https://github.com/labring/FastGPT/releases/tag/v4.14.9.5
• https://github.com/labring/FastGPT/security/advisories/GHSA-w36r-f268-pwrj

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 31, 2026

🔴 CVE-2026-34162 - Critical (10) FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-sup... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34162/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner