FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. This issue has been patched in version 4.14.9.5.
References
| Link | Resource |
|---|---|
| https://github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00 | Patch |
| https://github.com/labring/FastGPT/pull/6640 | Issue Tracking Patch |
| https://github.com/labring/FastGPT/releases/tag/v4.14.9.5 | Product Release Notes |
| https://github.com/labring/FastGPT/security/advisories/GHSA-w36r-f268-pwrj | Exploit Mitigation Vendor Advisory |
| https://github.com/labring/FastGPT/security/advisories/GHSA-w36r-f268-pwrj | Exploit Mitigation Vendor Advisory |
Configurations
History
01 Apr 2026, 18:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:fastgpt:fastgpt:*:*:*:*:*:*:*:* | |
| First Time |
Fastgpt
Fastgpt fastgpt |
|
| References | () https://github.com/labring/FastGPT/commit/bc7eae2ed61481a5e322208829be291faec58c00 - Patch | |
| References | () https://github.com/labring/FastGPT/pull/6640 - Issue Tracking, Patch | |
| References | () https://github.com/labring/FastGPT/releases/tag/v4.14.9.5 - Product, Release Notes | |
| References | () https://github.com/labring/FastGPT/security/advisories/GHSA-w36r-f268-pwrj - Exploit, Mitigation, Vendor Advisory |
31 Mar 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 15:16
Updated : 2026-04-01 18:38
NVD link : CVE-2026-34162
Mitre link : CVE-2026-34162
CVE.ORG link : CVE-2026-34162
JSON object : View
Products Affected
fastgpt
- fastgpt