CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

2 matches found

Vulnrichment•added 2026/04/10 4:39 p.m.•4 views

CVE-2026-40100 FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default

FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitrary URLs without authentication. The internal IP check in isInternalAddress only blocks private IPs when CHECKINTERNALIP=true, which is not the default. This allows...

5.3CVSS5.9AI score0.00253EPSS

SaveExploits0References1

OSV•added 2026/04/10 4:39 p.m.•10 views

CVE-2026-40100 FastGPT has Unauthenticated SSRF in /api/core/app/mcpTools/runTool via missing CHECK_INTERNAL_IP default

5.3CVSS6.1AI score

SaveExploits0References3

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by