Security
فارسی
All products

fastmcp

PyPI · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
FastMCP OpenAPI Provider has an SSRF & Path Traversal VulnerabilityCVE-2026-32871 · GHSA-VV7Q-7JX5-F767Version ranges need review. fastmcp PyPI Critical Fix reported
FastMCP: Post-transform component authorization is skipped on direct callsGHSA-7XGJ-8392-5Q4R fastmcp-slimfastmcp PyPI Medium Fix reported
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization serverGHSA-VQQP-X5QM-5QP4 fastmcp-slimfastmcp PyPI Medium Fix reported
FastMCP has a Command Injection vulnerability - Gemini CLICVE-2025-64340 · GHSA-M8X7-R2RG-VH5GVersion ranges need review. fastmcp PyPI Medium Fix reported
FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy VulnerabilitiesCVE-2026-27124 · GHSA-RWW4-4W9C-7733Version ranges need review. fastmcpRed Hat Developer Hub 1/rhdh/rhdh-hub-rhel9 PyPIRed Hat High Fix reported
FastMCP OAuth Proxy token reuse across MCP serversCVE-2025-69196 · GHSA-5H2M-4Q8J-PQPJVersion ranges need review. fastmcp PyPI High Fix reported
FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_nameCVE-2025-62801 · GHSA-RJ5C-58RQ-J5G5Version ranges need review. fastmcp PyPI Medium Fix reported
FastMCP vulnerable to reflected XSS in client's callback pageCVE-2025-62800 · GHSA-MXXR-JV3V-6PGCVersion ranges need review. fastmcp PyPI Medium Fix reported
FastMCP Auth Integration Allows for Confused Deputy Account TakeoverGHSA-C2JP-C369-7PVX fastmcp PyPI High Fix reported
FastMCP updated to MCP 1.23+ due to CVE-2025-66416GHSA-RCFX-77HG-W2WV fastmcp PyPI High Fix reported