CVE-2026-54607: FastGPT OpenAPI Schema Import SSRF Vulnerability

Technical summary

The vulnerability exists in FastGPT's OpenAPI schema import mechanism. The HTTP-tool validator checks only the top-level URL for safety before invoking SwaggerParser.bundle, a third-party library used to resolve and merge OpenAPI schema references. SwaggerParser.bundle independently fetches any remote $ref URLs to inline them into the final schema, but it does not honor FastGPT's internal-address filtering logic. This creates a gap: an authenticated user can supply a schema with $ref pointers targeting internal services (e.g., http://localhost:8080, private cloud metadata endpoints like 169.254.169.254, or internal Kubernetes DNS names), and SwaggerParser will resolve and return the actual content from those endpoints. The fetched data is then exposed back to the user in the import response or stored in the schema, enabling information disclosure. This is a Server-Side Request Forgery (SSRF) variant where the request is made by a schema parser rather than direct application code.

Business impact

This vulnerability creates a risk of unauthorized information disclosure within team environments. An employee or contractor with FastGPT team access could exfiltrate secrets, API keys, or configuration data from internal services, cloud metadata endpoints (potentially revealing instance identity tokens or role credentials), or other protected infrastructure. The impact is scoped to authenticated users, reducing blast radius compared to unauthenticated SSRF, but insider threats and compromised team accounts present real risk. Organizations using FastGPT to manage knowledge bases across multiple services may inadvertently expose sensitive integration details or backend system information.

Affected systems

FastGPT releases prior to version 4.15.0-beta4 are affected. The vulnerability is present in the HTTP-tool OpenAPI schema import feature, so organizations that use FastGPT and permit team members to import custom OpenAPI schemas are at risk. This includes any deployment where users can supply or modify schema definitions during tool setup or configuration.

Exploitability

Exploitation requires authentication as a FastGPT team member—the attacker cannot exploit this remotely without credentials. However, once authenticated, no special user interaction or additional complexity is needed; the attack is straightforward: create a malicious OpenAPI schema with $ref pointers to sensitive internal URLs and submit it via the import function. The vulnerability is inherent to how SwaggerParser.bundle works and does not require additional network access or privilege escalation. Internal threat actors or compromised team accounts pose the primary risk.

Remediation

Upgrade FastGPT to version 4.15.0-beta4 or later, which implements fixes to the OpenAPI schema import validation. The patch addresses the gap by ensuring that remote reference resolution is subject to the same internal-address guards applied at the top level. Organizations should verify the availability of stable release versions (4.15.0-beta4 is a beta release) and plan upgrade timing accordingly. During the interim, restrict OpenAPI schema import permissions to trusted administrators only, and monitor schema uploads for suspicious $ref patterns pointing to internal or cloud-metadata IPs.

Patch guidance

Upgrade to FastGPT 4.15.0-beta4 or any subsequent release. If you are running a version prior to 4.15.0-beta4, prioritize this update. Note that 4.15.0-beta4 is marked as a beta release; verify with the FastGPT project whether stable 4.15.0 or later versions are available for production environments. Test the upgrade in a non-production environment first to ensure compatibility with your deployment. After upgrading, validate that OpenAPI schema imports continue to function correctly for legitimate use cases.

Detection guidance

Monitor FastGPT logs and audit trails for OpenAPI schema imports, especially those containing $ref pointers to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254 for AWS, etc.). Track which team members are importing schemas and review the content of imported schemas for suspicious references. If you have network monitoring in place, look for unexpected outbound connections from FastGPT containers or pods to internal services or metadata endpoints. Review any schema imports that occurred before you patched the system to assess whether sensitive data may have been accessed.

Why prioritize this

This vulnerability merits high priority due to its CVSS 7.7 HIGH score and the sensitivity of the information that could be disclosed (internal service data, cloud credentials, API keys). Although it requires authentication, the barrier is team-member level rather than admin-only, increasing the pool of potential threat actors (disgruntled employees, contractors, compromised accounts). Information disclosure of internal architecture and credentials can enable follow-on attacks. Organizations with sensitive backend services or cloud deployments should patch urgently.

Risk score, explained

CVSS 7.7 reflects a HIGH-severity vulnerability with network attack vector (AV:N), low attack complexity (AC:L), and low privilege requirement (PR:L—team membership). The impact is limited to confidentiality (C:H) with no integrity or availability loss, but the scope is changed (S:C), meaning the compromise can affect resources beyond the security scope of the vulnerable component (internal services and metadata endpoints). The network-accessible nature combined with the ease of exploitation and potential for sensitive data disclosure justifies the elevated score.

Frequently asked questions