Vulnerability in FastGPT AI Platform by LabRing

CVE-2026-42345

What is CVE-2026-42345?

The FastGPT platform, utilized for AI agent creation, is vulnerable due to insufficient validation in its isInternalAddress() function. This function, intended to block access to crucial cloud metadata endpoints, can be circumvented using multiple URL encoding techniques. These techniques can evade the static blocklist checks, allowing unauthorized access to the metadata services. Moreover, the default configuration disables essential checks for private IP addresses, compounding the issue. As of now, no patches are available, leaving users exposed to potential exploitation.

References