CVE-2026-34163 - Vulnerability Analysis

Overview

FastGPT < 4.14.9.5 contains a server side request forgery caused by lack of internal address validation in MCP tools endpoints, letting authenticated attackers scan internal networks and access internal services.

Severity & Score

Impact

Authenticated attackers can scan internal networks and access sensitive internal services, potentially leading to data exposure or further compromise.

Mitigation

Upgrade to version 4.14.9.5 or later.

References

• https://github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00
• https://github.com/labring/FastGPT/pull/6640
• https://github.com/labring/FastGPT/releases/tag/v4.14.9.5
• https://github.com/labring/FastGPT/security/advisories/GHSA-x9vj-5m4j-9mfv

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 31, 2026

🟠 CVE-2026-34163 - High (7.7) FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools endpoints (/api/core/app/mcpTools/getTools and /api/core/app/mcpTools/runTool) accept a user-supplied URL parameter and make server-s... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-34163/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner