GHSA-7xgj-8392-5q4r: FastMCP: Post-transform component authorization is skipped on direct calls

Summary

FastMCP versions 3.0.0 through 3.4.9 and 4.0.0 through 4.1.1 skip the final authorization check on direct component lookups when a server transform changes the component's metadata. A low-privilege client that knows the transformed component name can invoke a tool or retrieve a resource or prompt that the configured policy denies. A denied concrete resource also shadows a matching proxy template at its URI.

Mitigation

Fixed in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• fastmcpPyPILLM dependency since 2024-11-30 · 15 tracked dependents
• fastmcp-slimPyPILLM dependency since 2026-05-11 · 4 tracked dependents

Related items

• MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSimilar attack · GitHub Advisory Database
• MediumCVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP ServerSimilar attack · AWS Security Bulletins
• MediumExposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute IntrusionsSimilar attack · The Hacker News
• HighCVE-2026-57208: Entire CLI path traversal via SessionID in checkpoint restoreSimilar attack · NVD/CVE Database
• MediumInfostealer riding the AI TrainSimilar attack · Check Point Research