TI-2026-25332 CVE-2026-32871 · GHSA-vv7q-7jx5-f767
FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
Priority HIGH 82
FastMCP is a Pythonic way to build MCP servers and clients.
jlowin
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
jlowin records in CISA KEVNo jlowin vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records in Fastmcp · all components
TI-2026-21575 CVE-2026-27124 · GHSA-rww4-4w9c-7733
FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities
Priority HIGH 75
FastMCP is the standard framework for building MCP applications.
TI-2025-39774 CVE-2025-64340 · GHSA-m8x7-r2rg-vh5g
FastMCP has a Command Injection vulnerability - Gemini CLI
Priority HIGH 69
FastMCP is the standard framework for building MCP applications.
TI-2025-42650 CVE-2025-69196 · GHSA-5h2m-4q8j-pqpj
FastMCP OAuth Proxy token reuse across MCP servers
Priority HIGH 66
FastMCP is the standard framework for building MCP applications.
TI-2025-38984 CVE-2025-62801 · GHSA-rj5c-58rq-j5g5
FastMCP vulnerable to windows command injection in FastMCP Cursor installer via server_name
Priority MEDIUM 60
FastMCP is the standard framework for building MCP applications.
TI-2025-38983 CVE-2025-62800 · GHSA-mxxr-jv3v-6pgc
FastMCP vulnerable to reflected XSS in client's callback page
Priority MEDIUM 57
FastMCP is the standard framework for building MCP applications.