diff --git a/.worktrees/feat-dash-rule-adapter b/.worktrees/feat-dash-rule-adapter
new file mode 160000
index 0000000..8a6aacc
--- /dev/null
+++ b/.worktrees/feat-dash-rule-adapter
@@ -0,0 +1 @@
+Subproject commit 8a6aacc45b6c714ccafc5410a2d98054a0123083
diff --git a/.worktrees/non-dash-release b/.worktrees/non-dash-release
new file mode 160000
index 0000000..608fbf7
--- /dev/null
+++ b/.worktrees/non-dash-release
@@ -0,0 +1 @@
+Subproject commit 608fbf74def5c863d9e99ab7c458b7da6f527d7c
diff --git a/go-backend/internal/http/handler/federation.go b/go-backend/internal/http/handler/federation.go
index 62fd3ec..3698b9e 100644
--- a/go-backend/internal/http/handler/federation.go
+++ b/go-backend/internal/http/handler/federation.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/url"
 	"sort"
 	"strconv"
 	"strings"
@@ -636,6 +637,16 @@ func (h *Handler) nodeImport(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	rUrl, err := url.Parse(req.RemoteURL)
+	if err != nil || (rUrl.Scheme != "http" && rUrl.Scheme != "https") {
+		response.WriteJSON(w, response.ErrDefault("Invalid Remote URL format"))
+		return
+	}
+	if err := IsSafeRemoteAddr(rUrl.Host); err != nil {
+		response.WriteJSON(w, response.Err(403, "禁止将远程节点地址设置为内部网络或保留地址"))
+		return
+	}
+
 	domainCfg, _ := h.repo.GetConfigByName("panel_domain")
 	localDomain := ""
 	if domainCfg != nil {
diff --git a/go-backend/internal/http/middleware/auth.go b/go-backend/internal/http/middleware/auth.go
index 68ac48b..e739ac7 100644
--- a/go-backend/internal/http/middleware/auth.go
+++ b/go-backend/internal/http/middleware/auth.go
@@ -109,7 +109,7 @@ func requiresAdmin(path string) bool {
 		return true
 	}
 
-	if strings.HasPrefix(path, "/api/v1/federation/share/") {
+	if strings.HasPrefix(path, "/api/v1/federation/share/") || strings.HasPrefix(path, "/api/v1/federation/node/") {
 		return true
 	}