Advisoriesby Ibis
fastmcp security advisories
10 advisories · 4 critical or high in 12 months · latest Oct 23
10 advisories
FastMCP: Post-transform component authorization is skipped on direct callsGHSA-7xgj-8392-5q4rfixed in 3.4.10 +1fastmcp: improper authenticationGHSA-vqqp-x5qm-5qp4fixed in 4.1.2FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityCVE-2026-32871fixed in 3.2.0FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesCVE-2026-27124fixed in 3.2.0FastMCP has a Command Injection vulnerability - Gemini CLICVE-2025-64340fixed in 3.2.0FastMCP OAuth Proxy token reuse across MCP serversCVE-2025-69196fixed in 2.14.2FastMCP updated to MCP 1.23+ due to CVE-2025-66416GHSA-rcfx-77hg-w2wvfixed in 2.14.0FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_nameCVE-2025-62801fixed in 2.13.0FastMCP vulnerable to reflected XSS in client's callback pageCVE-2025-62800fixed in 2.13.0FastMCP Auth Integration Allows for Confused Deputy Account TakeoverGHSA-c2jp-c369-7pvxfixed in 2.13.0About fastmcp
🚀 The fast, Pythonic way to build MCP servers and clients.
Packages watched: fastmcp (PyPI).