Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. This issue has been patched in version 4.14.9.5.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-31 | 4 | Disclosure1General1Patch2 |
| 2026-04-01 | 3 | Disclosure2Patch1 |
Security Advisory: CVE-2026-34162: FastGPT Unauthenticated HTTP Proxy Enables Full SSRF (CVSS 10.0) https://labs.cosmicbytez.ca/security/cve-2026-34162 #Cybersecurity #InfoSec #CVE #PatchNow
Post summary
The advisory announces CVE‑2026‑34162, an unauthenticated HTTP proxy vulnerability that allows full SSRF, providing technical details but no patch or exploit information.
[CVE-2026-34162: CRITICAL] Warning: FastGPT platform vulnerability detected! Prior to version 4.14.9.5, its HTTP testing endpoint lacks authentication. Update to the latest version to close this security flaw.#cve,CVE-2026-34162,#cybersecurity https://cvefind.com/CVE-2026-34162
Post summary
FastGPT’s pre‑4.14.9.5 releases expose an unauthenticated HTTP testing endpoint; the vendor recommends updating to the latest version to remediate the flaw.
CVE-2026-34162 FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any … https://www.cve.org/CVERecord?id=CVE-2026-34162
Post summary
FastGPT’s HTTP tools endpoint was exposed before version 4.14.9.5; this version’s release fixes the issue, providing an available patch.
🔴 CVE-2026-34162 - Critical FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This ... https://www.thehackerwire.com/vulnerability/CVE-2026-34162/ https://t.co/H5mzLERQAJ
Post summary
FastGPT versions before 4.12.9.5 expose an HTTP tools test endpoint without authentication, creating a critical vulnerability.
🚨 CVE-2026-34162: FastGPT: Unauthenticated SSRF vi... Perfect SSRF-to-RCE chain: unauthenticated proxy endpoint lets attackers hit internal APIs, steal cloud metadata, and p... https://zerodaysignal.com/vulnerability/CVE-2026-34162 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post references CVE‑2026‑34162, detailing an unauthenticated SSRF that can lead to RCE, but offers no PoC, exploit code, patch, or evidence of active exploitation.
Warning: Critical missing authentication in #FastGPT. #CVE-2026-34162 (CVSS: 9.8) allows an unauthenticated attacker to exfiltrate API tokens, access internal services and send arbitrary HTTP-request! See our advisory: https://ccb.belgium.be/advisories/warning-critical-vulnerability-fastgpt-patch-immediately #Patch #Patch #Patch
Post summary
FastGPT suffers a critical missing authentication flaw (CVE‑2026‑34162) that enables token exfiltration and arbitrary requests; an advisory urges users to apply the available patch immediately.
🔍 Today's Top Vulnerabilities 🔴 CVE-2026-34162 | CVSS 10.0 🔴 CVE-2026-34156 | CVSS 9.9 🔴 CVE-2026-34243 | CVSS 9.8 🔗 http://ctiwatch.cloud/vulnerabilities #CVE #Vulnerability #ThreatIntel
Post summary
The post announces several newly disclosed vulnerabilities with very high CVSS scores, but provides no further details on exploitation, patches, or false positives.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fastgpt | fastgpt | - | - | - |