CVE-2026-84301 in FastGPT
Summary
by MITRE • 09/22/2026
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress() before a later HTTP connection performs an independent DNS lookup, creating a DNS rebinding window, allowing an attacker-controlled hostname to resolve publicly during the check and to a loopback, private, link-local, or metadata address during connection. An authenticated attacker who can supply a URL to a safe-Axios-backed HTTP tool, workflow HTTP node, external file fetch, or other server-side integration can use this time-of-check/time-of-use gap to reach services that direct private-address inputs would block. The same independent re-resolution occurs after manual redirect hops because each redirect target is checked before a separate connection lookup. This issue is fixed in version 4.15.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
FastGPT, an open-source large language model platform designed for constructing AI applications on knowledge bases, contains a critical server-side request forgery vulnerability affecting versions prior to 4.15.2. The core of this issue lies in the implementation of the safe Axios request interceptor located within the packages/service/common/api/axios.ts module. This component is intended to prevent unauthorized access by validating hostnames against internal or private address ranges before initiating HTTP connections. However, the validation mechanism suffers from a fundamental architectural flaw known as a time-of-check-to-time-of-use race condition. Specifically, the system performs an initial DNS lookup using the isInternalAddress() function to determine if the target hostname resolves to a safe public IP address. If this check passes, the application proceeds to establish the actual HTTP connection, which triggers a second, independent DNS resolution process. This separation between validation and execution creates a temporal window during which the domain's DNS records can be manipulated by an attacker.
The operational impact of this vulnerability is significant for environments where FastGPT processes URLs provided by users or integrates with external services through workflows. An authenticated attacker who has the ability to supply a URL to any HTTP tool, workflow node, or server-side integration point within the platform can exploit this gap. By controlling the DNS records for a domain name that passes the initial internal address check, an attacker can configure their authoritative nameserver to return different IP addresses at different times. During the validation phase, the hostname resolves to a public IP address, satisfying the isInternalAddress() filter. However, by the time the actual HTTP connection attempt occurs, the DNS record has been updated to resolve to a loopback, private, link-local, or cloud metadata address. This allows the attacker to bypass security controls that are designed to block requests to internal services, effectively enabling Server-Side Request Forgery against resources that would otherwise be inaccessible from the public internet.
This vulnerability extends beyond simple direct connections and also affects manual redirect hops within FastGPT's HTTP handling logic. When a request encounters an HTTP redirect, each intermediate target is subjected to its own validation check before a new connection lookup is performed. Because these checks are not atomic with respect to the final network state, an attacker can similarly exploit DNS rebinding techniques during redirects. This means that even if the initial URL appears safe, subsequent hops in the redirection chain can be manipulated to point toward internal infrastructure services. The ability to reach metadata endpoints or private APIs poses severe risks, including unauthorized access to sensitive configuration data, lateral movement within a networked environment, and potential compromise of underlying cloud instances through their instance metadata service interfaces.
From a classification perspective, this vulnerability aligns with CWE-367, which describes time-of-check-time-of-use (TOCTOU) race conditions in security features. The exploitation technique is consistent with MITRE ATT&CK tactic T1502, specifically the sub-technique of Service Scan or potentially T1498 Network Denial of Service if used to flood internal services, though its primary utility lies in reconnaissance and unauthorized access via SSRF techniques similar to those categorized under TA0008 Lateral Movement. The root cause is a failure to ensure atomicity between security checks and resource access, allowing the state of the external dependency (DNS) to change unpredictably between verification and use.
To mitigate this vulnerability, organizations running FastGPT must upgrade immediately to version 4.15.2 or later, where the developers have addressed the race condition by ensuring that DNS resolution is performed atomically with connection establishment or by validating IP addresses directly rather than relying solely on hostname checks followed by separate lookups. In environments where upgrading is not immediately feasible, network-level controls such as egress filtering can provide a secondary layer of defense. By restricting outbound connections from FastGPT servers to only known and necessary public endpoints, administrators can prevent the application from reaching internal IP ranges regardless of DNS manipulation. Additionally, implementing strict allowlists for permitted domains in workflow configurations reduces the attack surface available to authenticated users who might attempt to exploit this flaw.