Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts blocks cloud metadata endpoints using a fullUrl.startsWith() check against a hardcoded list. This check can be bypassed using at least 7 different URL encoding techniques, all of which resolve to the same cloud metadata service but do not match the blocklist patterns. Additionally, the broader private IP check (isInternalIPv4/isInternalIPv6) is disabled by default because CHECK_INTERNAL_IP defaults to false (not 'true'), so these bypasses reach the metadata endpoint without any further validation. At time of publication, there are no publicly available patches.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-42345 FastGPT is an AI Agent building platform. In versions 4.14.11 and prior, FastGPT's isInternalAddress() function in packages/service/common/system/utils.ts blocks clou… https://www.cve.org/CVERecord?id=CVE-2026-42345
Post summary
CVE‑2026‑42345 discloses an issue in FastGPT's isInternalAddress() function affecting versions 4.14.11 and prior, but no exploit or patch details are present.
CVE-2026-42345 Cloud Metadata Endpoint Access Bypass in FastGPT 4.14.11 and Prior https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42345
Post summary
The tweet announces CVE-2026-42345, a Cloud Metadata Endpoint access bypass in FastGPT versions 4.14.11 and earlier, without providing a PoC, exploit, or mitigation.