DNS Rebinding Vulnerability in FastGPT Open-Source AI Platform

CVE-2026-84301

What is CVE-2026-84301?

FastGPT, an open-source large language model (LLM) platform for AI applications, has a DNS rebinding vulnerability prior to version 4.15.2. This issue arises because the Axios request interceptor in the application does not adequately validate hostnames, creating a window wherein an attacker can exploit a time-of-check/time-of-use gap. An authenticated attacker leveraging this vulnerability can craft a malicious hostname that resolves first to a public address and subsequently to a private or link-local address, thereby bypassing security measures and accessing services that are otherwise protected. This vulnerability is addressed in version 4.15.2, which enhances hostname validation during HTTP requests and connection establishment.

References