prefecthq/fastmcp Security Advisories | GitStock

medium2026-10-23

FastMCP: Post-transform component authorization is skipped on direct calls

GHSA-7xgj-8392-5q4r

medium2026-10-23

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

GHSA-vqqp-x5qm-5qp4

critical2026-03-31

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

GHSA-vv7q-7jx5-f767 · CVE-2026-32871

high2026-03-31

FastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities

GHSA-rww4-4w9c-7733 · CVE-2026-27124

medium2026-03-31

FastMCP has a Command Injection vulnerability - Gemini CLI

GHSA-m8x7-r2rg-vh5g · CVE-2025-64340

high2026-03-16

FastMCP OAuth Proxy token reuse across MCP servers

GHSA-5h2m-4q8j-pqpj · CVE-2025-69196