VulnSea

fastmcp has 4 CVEs on record. 2 were published in the last 90 days. The median CVSS is 6.7 (medium).

CVEs per month

Last 12 months, by publish date

111201020304050607080910
Exploited share
0% vs 1% corpus
Median CVSS
6.7
Publish → KEV
—
Last 90 days
2 prev 0

Products

  • fastmcp 4
Follow fastmcp:RSS feedSave a search →Embed badge ↗
4
Total CVEs
0
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

fastmcp vulnerabilities

CVEs affecting fastmcp, newest first. Open any entry for full detail, references, and exploit status.

4 CVEsRSS

GHSA-vqqp-x5qm-5qp4Medium· 5.9
5d ago

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised auth…

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

▾ Sunlitfastmcp · fastmcpvia OSV
GHSA-7xgj-8392-5q4rMedium· 6.8
5d ago

FastMCP: Post-transform component authorization is skipped on direct calls

FastMCP: Post-transform component authorization is skipped on direct calls

▾ Sunlitfastmcp · fastmcpvia OSV
CVE-2026-27124High
7mo ago

FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

▾ Twilightfastmcp · fastmcpEPSS 0.21%via OSV
CVE-2025-64340Medium· 6.7
7mo ago

FastMCP has a Command Injection vulnerability - Gemini CLI

FastMCP has a Command Injection vulnerability - Gemini CLI

▾ Sunlitfastmcp · fastmcpEPSS 0.73%via OSV
fastmcp vulnerabilities (CVEs) · VulnSea