{"data":{"id":"ccbccb7b-fec5-4756-b6de-852d1e20ceb9","title":"CVE-2026-40100: FastGPT is an AI Agent building platform. Prior to 4.14.10.3, the /api/core/app/mcpTools/runTool endpoint accepts arbitr","summary":"FastGPT, an AI Agent building platform, has a vulnerability in versions before 4.14.10.3 where an endpoint accepts URLs without proper authentication checks, allowing unauthenticated attackers to perform SSRF (server-side request forgery, where an attacker tricks the server into making requests to internal network resources) attacks against internal systems. The vulnerability exists because the internal IP check is disabled by default.","solution":"Update FastGPT to version 4.14.10.3 or later, where this vulnerability is fixed.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40100","publishedAt":"2026-04-10T17:17:12.997Z","cveId":"CVE-2026-40100","cweIds":["CWE-918"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["rag_poisoning"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["LangChain"],"affectedVendorsRaw":["FastGPT"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"patchAvailable":null,"disclosureDate":"2026-04-10T17:17:12.997Z","capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0020","AML.T0051.001"]}}