How severe is CVE-2026-34162?

CVE-2026-34162 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.

Is CVE-2026-34162 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-34162?

CVE-2026-34162 affects Fastgpt. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-34162?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2026-34162 have an EU (EUVD) identifier?

Yes. CVE-2026-34162 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-17445.

When was CVE-2026-34162 published?

CVE-2026-34162 was published on 2026-03-31 and last updated on 2026-07-24.

CVE-2026-34162

CVE-2026-34162 is a critical-severity vulnerability in Fastgpt with a CVSS 3.x base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-306.

Key facts

Severity: Critical (CVSS 3.x base score 10.0)
EPSS exploit prediction: 0% (35th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-17445
Weakness: CWE-306
Affected product: Fastgpt
Published: 2026-03-31
Last modified: 2026-07-24

Description

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. This issue has been patched in version 4.14.9.5.

Frequently asked questions

What is CVE-2026-34162?: FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. This issue has been patched in version 4.14.9.5.
How severe is CVE-2026-34162?: CVE-2026-34162 has a CVSS 3.x base score of 10.0, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
Is CVE-2026-34162 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (35th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-34162?: CVE-2026-34162 affects Fastgpt. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-34162?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2026-34162 have an EU (EUVD) identifier?: Yes. CVE-2026-34162 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-17445.
When was CVE-2026-34162 published?: CVE-2026-34162 was published on 2026-03-31 and last updated on 2026-07-24.

References

Affected products (1)

cpe:2.3:a:fastgpt:fastgpt:*:*:*:*:*:*:*:*

More vulnerabilities in Fastgpt

CVE-2026-40351 — Critical (CVSS 9.8): FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password-based login endpoint uses…
CVE-2026-40352 — High (CVSS 8.8): FastGPT is an AI Agent building platform. In versions prior to 4.14.9.5, the password change endpoint is vulnerable to…
CVE-2026-33075 — High (CVSS 8.8): FastGPT is an AI Agent building platform. In versions 4.14.8.3 and below, the fastgpt-preview-image.yml workflow is…
CVE-2026-40252 — High (CVSS 8.1): FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows…
CVE-2026-34163 — High (CVSS 7.7): FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, FastGPT's MCP (Model Context Protocol) tools…
CVE-2025-27600 — Medium (CVSS 6.5): FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP…

All CVEs affecting Fastgpt →

Other CWE-306 (Missing Authentication for Critical Function) vulnerabilities

CVE-2026-20357 — Critical (CVSS 10.0): As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team…
CVE-2026-58115 — Critical (CVSS 10.0): A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running…
CVE-2026-63508 — Critical (CVSS 10.0): Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to…
CVE-2026-56163 — Critical (CVSS 10.0): Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to…
CVE-2026-64812 — Critical (CVSS 10.0): In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session
CVE-2026-60644 — Critical (CVSS 10.0): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management).…

Browse all CWE-306 (Missing Authentication for Critical Function) vulnerabilities →