External risk intelligence

FastGPT Unauthenticated HTTP Proxy Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-34162

The vulnerable component is a public-facing web API endpoint designed to be accessed by users or client applications. Because this endpoint performs server-side requests without authentication as a core function of the platform, it is inherently exposed to the internet in standard deployments.

Missing Authentication

Fastgpt

before 4.14.9.5

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in FastGPT, an AI agent platform, that could allow unauthenticated access to a tool testing endpoint. If exploited, this could lead to the execution of arbitrary HTTP requests on behalf of the server, potentially exposing sensitive information or enabling further unauthorized actions. The primary concern is confirming if this specific platform is in use and if this endpoint is accessible externally.

Unauthenticated access to AI platform tools.
Matters if FastGPT is deployed externally.
Confirm FastGPT usage and external exposure.

Attack Path

How an attacker could exploit the issue

An attacker can leverage an unauthenticated HTTP tools testing endpoint to make arbitrary server-side requests. This proxy functionality allows an attacker to interact with internal or external services from the perspective of the FastGPT server, potentially leading to unauthorized access or data manipulation.

No authentication required.
Calls internal/external HTTP services.
Leads to server-side request forgery.

Live Threat

Current exploitation, exposure, and threat context

The FastGPT HTTP tools testing endpoint, when unpatched, could allow an unauthenticated attacker to relay arbitrary HTTP requests from the FastGPT server to any external or internal network resource. This could expose sensitive internal services or lead to unauthorized access to information.

Internal network services could be exposed.
Server-side requests could be proxied.
Unauthorized access to internal resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this vulnerability in FastGPT, as it affects an AI agent building platform with an exposed HTTP testing endpoint. The immediate priority is to identify all instances of FastGPT within your environment, confirm their exposure and criticality, and then assign ownership for remediation planning.

Own: Application or platform team.
Verify: Affected instances and exposure.
Action: Plan and implement remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FastGPT?

FastGPT is a software platform designed for building and managing AI agents. Users leverage it to create conversational interfaces and automated workflows. The platform includes various utility features, such as HTTP tools for testing connections and integrations, which allow developers to verify how their agents interact with external services or APIs.

What does CVE-2026-34162 mean for security?

This CVE involves a Missing Authentication for Critical Function (CWE-306) and Server-Side Request Forgery (CWE-918). In plain English, the software's tool-testing feature incorrectly assumes requests are authorized. Because this mechanism acts as a proxy, an attacker can use it to force the FastGPT server to send requests to other targets on their behalf, essentially using the server as a jumping-off point to interact with services it can reach.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted network requests to the specific tool-testing API endpoint in FastGPT. Because the endpoint does not require any credentials, the server will process these requests immediately. Notably, simply browsing the main FastGPT dashboard or using other standard agent features does not trigger this flaw; the vulnerability is specifically limited to actions directed at the `/api/core/app/httpTools/runTool` endpoint.

Why is this a concern for my network?

According to Halo Surface Signal, this vulnerability is highly relevant because the affected endpoint is a public-facing API. Because the server itself initiates the outgoing connections, it can bypass perimeter defenses to reach internal resources that would normally be hidden from the internet. Even if your FastGPT instance is intended for internal use, any external connectivity makes this a significant risk for unauthorized access to your private infrastructure.

How do I secure my FastGPT installation?

The most effective first step is to upgrade your FastGPT deployment to version 4.14.9.5 or later. This version includes a patch that adds the necessary authentication checks to the affected HTTP tools endpoint. If you cannot update immediately, you should isolate the instance from the network or use firewall rules to restrict access to the API endpoint until the update can be applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.