Vulnerabilities

TI-2026-21575 CVE-2026-27124 · GHSA-rww4-4w9c-7733

FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

HIGH 75

FastMCP is the standard framework for building MCP applications.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00211 Published 2026-04-03 Partial fix · 3.2.0 CWE-441

TI-2025-39774 CVE-2025-64340 · GHSA-m8x7-r2rg-vh5g

HIGH 69

FastMCP is the standard framework for building MCP applications.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00748 Published 2026-04-03 Fixed in 3.2.0 CWE-78

TI-2026-25332 CVE-2026-32871 · GHSA-vv7q-7jx5-f767

HIGH 82

FastMCP is a Pythonic way to build MCP servers and clients.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00925 Published 2026-04-02 Fixed in 3.2.0 CWE-918

TI-2025-42650 CVE-2025-69196 · GHSA-5h2m-4q8j-pqpj

HIGH 66

FastMCP is the standard framework for building MCP applications.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.0038 Published 2026-03-16 Fixed in 2.14.2 CWE-863

TI-2025-38984 CVE-2025-62801 · GHSA-rj5c-58rq-j5g5

MEDIUM 60

FastMCP is the standard framework for building MCP applications.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00227 Published 2025-10-28 Fixed in 2.13.0 CWE-78

TI-2025-38983 CVE-2025-62800 · GHSA-mxxr-jv3v-6pgc

MEDIUM 57

FastMCP is the standard framework for building MCP applications.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00276 Published 2025-10-28 Fixed in 2.13.0 CWE-79