fastmcp vulnerabilities
CVEs whose affected-version data names the fastmcp package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
8 CVEsRSS
GHSA-vqqp-x5qm-5qp4Medium· 5.9FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised auth…
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
GHSA-7xgj-8392-5q4rMedium· 6.8FastMCP: Post-transform component authorization is skipped on direct calls
FastMCP: Post-transform component authorization is skipped on direct calls
CVE-2026-32871Critical· 10.0FastMCP is a Pythonic way to build MCP servers and clients
FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for const…
CVE-2026-27124HighFastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
CVE-2025-64340Medium· 6.7FastMCP has a Command Injection vulnerability - Gemini CLI
FastMCP has a Command Injection vulnerability - Gemini CLI
CVE-2025-69196Medium· 6.5FastMCP is the standard framework for building MCP applications
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the …
CVE-2025-62801High· 7.8FastMCP is the standard framework for building MCP applications
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hos…
CVE-2025-62800Medium· 6.1FastMCP is the standard framework for building MCP applications
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values ar…