CVE-2026-44285: FastGPT SSRF Vulnerability in Dataset Preview Endpoint

Technical summary

The vulnerability resides in the /api/core/dataset/file/getPreviewChunks endpoint and stems from an incomplete implementation of the isInternalAddress network protection mechanism. When an authenticated user requests a file preview through the externalFile data import type, the endpoint fails to properly validate that target URLs do not point to internal network addresses. An attacker can craft requests that circumvent the protection, enabling arbitrary HTTP GET requests to internal services such as metadata services, internal APIs, or other network-accessible resources. The fix in version 4.15.0-beta1 addresses this bypass by implementing more robust URL validation logic.

Business impact

This vulnerability enables credential-holding insiders or compromised legitimate accounts to conduct reconnaissance and exfiltration attacks against internal infrastructure without triggering typical external network monitoring. An attacker could enumerate internal services, extract configuration data, access administrative dashboards, or retrieve sensitive information from databases exposed on the internal network. For organizations running FastGPT in environments with sensitive internal services, this represents a material data confidentiality risk and could facilitate lateral movement attacks within the network.

Affected systems

FastGPT versions prior to 4.15.0-beta1 are affected. Organizations running any release in the 4.14.x branch, 4.13.x branch, or earlier are at risk. The vulnerability requires authentication, so only users with valid FastGPT credentials can exploit it. Systems with FastGPT deployed in network segments containing sensitive internal services or databases are at highest risk.

Exploitability

Exploitability is moderate-to-high because the attack requires valid authentication credentials but no additional user interaction. An attacker with a compromised or rogue account, or an insider with legitimate access, can immediately begin probing internal networks. The attack surface is straightforward: any authenticated user can craft requests to the vulnerable endpoint. However, actual impact depends on what internal services are present and accessible from the FastGPT deployment's network segment. The simplicity of exploitation (crafting HTTP GET requests) lowers the technical barrier.

Remediation

Upgrade FastGPT to version 4.15.0-beta1 or later to apply the complete fix for the isInternalAddress validation bypass. Organizations unable to upgrade immediately should implement network-level mitigations: isolate FastGPT instances to restricted network segments, apply firewall rules to prevent outbound connections to internal service ranges, and restrict FastGPT user account creation to trusted administrators only. Monitor authentication logs for unusual activity and review access controls on internal services that might be reachable from FastGPT.

Patch guidance

Apply version 4.15.0-beta1 or any subsequent stable release as soon as feasible. Verify the patch against the vendor advisory to confirm the version installed includes the corrected isInternalAddress validation logic. Beta versions should be tested in a staging environment before production deployment. If production deployment of a beta is necessary, combine it with compensating network controls until a stable release is available.

Detection guidance

Monitor FastGPT access logs for requests to /api/core/dataset/file/getPreviewChunks with externalFile parameters pointing to internal IP ranges (RFC 1918 addresses, link-local addresses, or local loopback). Correlate unusual preview requests with internal network traffic captures to identify outbound connections from FastGPT to unexpected internal services. Network IDS/IPS signatures should flag HTTP requests originating from FastGPT systems to internal service ports that should not be accessed. Review authentication logs for brute-force or unauthorized account creation attempts preceding such requests.

Why prioritize this

This vulnerability merits high priority despite being confined to authenticated users because (1) it bypasses network security controls, (2) it provides direct access to internal infrastructure confidentiality, (3) insider or account-compromise scenarios are common, and (4) the fix is available. Organizations with sensitive internal services adjacent to FastGPT deployments should prioritize patching within 2-4 weeks. Those in higher-trust environments or with strong network segmentation may extend timelines slightly, but should not defer indefinitely.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) reflects: Attack Vector Network (AV:N) because the endpoint is web-accessible; Access Complexity Low (AC:L) indicating straightforward exploitation; Privileges Required (PR:L) acknowledging the authentication prerequisite; User Interaction None (UI:N) as no social engineering is needed; Scope Changed (S:C) because the attacker can access services outside the FastGPT application boundary; Confidentiality High (C:H) as internal service data is exposed; Integrity None (I:N) and Availability None (A:N) as this is read-only SSRF. The score appropriately captures the confidentiality risk while reflecting that pre-authentication and the read-only nature prevent maximum severity ratings.

Frequently asked questions