CVE-2026-34162 is a critical (CVSS 10.0) flaw in FastGPT, the AI agent platform. A tool-testing endpoint needs no login and makes server-side requests for the caller. The maintainers fixed it in version 4.14.9.5, so upgrade there or later. Block that path at the proxy meanwhile.
What's affected
The NVD record says versions before 4.14.9.5. The project's advisory (GHSA-w36r-f268-pwrj) lists 4.14.8.3 and earlier as affected and names 4.14.9.5 as the patched release. Use 4.14.9.5 or later, since the two ranges leave a gap in between.
The endpoint is /api/core/app/httpTools/runTool. According to the advisory it takes a base URL, a path, an HTTP method, headers and a body from the caller, makes the request from the server, and returns the full response. No authentication is needed.
The advisory's title says the issue leads to theft of an internal API key. That is the consequence the researchers describe: a server that can be told to call internal addresses can reveal what lives there.
How to check if you're exposed
Check your FastGPT version, for example from the container image tag or the version shown in the app, and compare it with 4.14.9.5.
Then look at exposure. Test, from outside your network, whether the path /api/core/app/httpTools/runTool answers without credentials. Do this only against your own deployment. A 401 or 403 response suggests a gate exists; a normal response does not.
Check your reverse proxy and web logs for calls to that path, and look at the callers' addresses and the target hosts they asked for. Unfamiliar internal addresses in that list are a warning sign.
If your logs record request bodies or target hosts, search for requests to the path that name internal addresses, such as private ranges or cloud metadata addresses. Those are the calls that matter most.
What to do now
- Upgrade FastGPT to 4.14.9.5 or later.
- Block
/api/core/app/httpTools/runToolat the reverse proxy for unauthenticated callers until the upgrade is done. - Review logs for calls to that path from addresses you do not know.
- Rotate internal API keys and tokens that could have been reached through the server, if you see any suspicious calls.
- Restrict outbound requests from the FastGPT host so it cannot reach the metadata service or internal admin interfaces.
- Keep model and tool credentials in a secret store, not in services reachable from the app.
Why it matters
The record lists CWE-306 (missing authentication for a critical function) and CWE-918 (server-side request forgery). The two combine badly. SSRF lets a caller borrow the server's network position, including access to services that were never meant to be public. Missing authentication means anyone on the internet can do the borrowing.
A tool that tests HTTP calls is useful to builders and risky to expose. The safe pattern is to put such features behind login, restrict the targets it may call, and block internal address ranges from outbound requests.
The record does not mark this CVE as exploited, and it is not on the CISA KEV list. Both the base score and the severity come from the NVD data.
Network controls help here as well. A server that can call anywhere will do so on behalf of an attacker. Allow outbound traffic only to the destinations the application needs, and block link-local and private ranges unless a feature requires them.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the two version ranges differ?
NVD says before 4.14.9.5, while the advisory lists 4.14.8.3 and earlier as affected. Use 4.14.9.5 or later to be safe.
Sources
Last reviewed: 19 October 2026.
