FastMCP: Post-transform component authorization is skipped on direct calls
## Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies. The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported. Affected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates. Fixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform. ## Original report # Post-trans
- Products
- fastmcp, fastmcp-slim
- Affected versions
- 3.0.0, 3.0.1, 3.0.2, 3.1.0, 3.1.1, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3.0, 3.3.0b1, 3.3.0b2, 3.3.1, 3.4.0, 3.4.0b1, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.4.9, 4.0.0, 4.0.1, 4.0.10, 4.0.11, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 4.1.0, 4.1.1
- Fixed versions
- 3.4.10, 4.1.2
- CVEs
- Not specified
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 03:19 UTC · Revision 1
Source evidence
FastMCP: Post-transform component authorization is skipped on direct calls
core-osv · Original sourcePublished 23 Oct 2026, 21:32 UTC
## Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies. The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported. Affected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates. Fixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform. ## Original report # Post-trans
osv:GHSA-7xgj-8392-5q4r
fastmcp
Fixed versions: 3.4.10
fastmcp
Fixed versions: 4.1.2
fastmcp-slim
Fixed versions: 3.4.10
fastmcp-slim
Fixed versions: 4.1.2
Complete source record
{
"id": "ef31ead45d148fa981335ea7408dfb9036ac665dfc7d0e1ac3db13d547f18e00",
"url": "https://osv.dev/vulnerability/GHSA-7xgj-8392-5q4r",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "FastMCP: Post-transform component authorization is skipped on direct calls",
"summary": "## Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies. The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported. Affected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates. Fixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform. ## Original report # Post-trans",
"evidence": "osv:GHSA-7xgj-8392-5q4r",
"products": [
{
"name": {
"value": "fastmcp",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "3.0.0",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.2",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.0",
"evidence": "/affected/0/versions"
},
{
"value": "3.1.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.2.0",
"evidence": "/affected/0/versions"
},
{
"value": "3.2.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.2.2",
"evidence": "/affected/0/versions"
},
{
"value": "3.2.3",
"evidence": "/affected/0/versions"
},
{
"value": "3.2.4",
"evidence": "/affected/0/versions"
},
{
"value": "3.3.0",
"evidence": "/affected/0/versions"
},
{
"value": "3.3.0b1",
"evidence": "/affected/0/versions"
},
{
"value": "3.3.0b2",
"evidence": "/affected/0/versions"
},
{
"value": "3.3.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.0",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.0b1",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.1",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.2",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.3",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.4",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.5",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.6",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.7",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.8",
"evidence": "/affected/0/versions"
},
{
"value": "3.4.9",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "fastmcp",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.1.2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "4.0.0",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.1",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.10",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.11",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.2",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.3",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.4",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.5",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.6",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.7",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.8",
"evidence": "/affected/1/versions"
},
{
"value": "4.0.9",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.0",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "fastmcp-slim",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "3.4.10",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "3.3.0",
"evidence": "/affected/2/versions"
},
{
"value": "3.3.0b1",
"evidence": "/affected/2/versions"
},
{
"value": "3.3.0b2",
"evidence": "/affected/2/versions"
},
{
"value": "3.3.1",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.0",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.0b1",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.1",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.2",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.3",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.4",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.5",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.6",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.7",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.8",
"evidence": "/affected/2/versions"
},
{
"value": "3.4.9",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "fastmcp-slim",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.1.2",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": [
{
"value": "4.0.0",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.1",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.10",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.11",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.2",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.3",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.4",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.5",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.6",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.7",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.8",
"evidence": "/affected/3/versions"
},
{
"value": "4.0.9",
"evidence": "/affected/3/versions"
},
{
"value": "4.1.0",
"evidence": "/affected/3/versions"
},
{
"value": "4.1.1",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "GHSA-7xgj-8392-5q4r",
"aliases": [
"GHSA-7xgj-8392-5q4r"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.4.10"
}
]
}
],
"package": {
"name": "fastmcp",
"purl": "pkg:pypi/fastmcp",
"ecosystem": "PyPI"
},
"versions": [
"3.0.0",
"3.0.1",
"3.0.2",
"3.1.0",
"3.1.1",
"3.2.0",
"3.2.1",
"3.2.2",
"3.2.3",
"3.2.4",
"3.3.0",
"3.3.0b1",
"3.3.0b2",
"3.3.1",
"3.4.0",
"3.4.0b1",
"3.4.1",
"3.4.2",
"3.4.3",
"3.4.4",
"3.4.5",
"3.4.6",
"3.4.7",
"3.4.8",
"3.4.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7xgj-8392-5q4r/GHSA-7xgj-8392-5q4r.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.2"
}
]
}
],
"package": {
"name": "fastmcp",
"purl": "pkg:pypi/fastmcp",
"ecosystem": "PyPI"
},
"versions": [
"4.0.0",
"4.0.1",
"4.0.10",
"4.0.11",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.6",
"4.0.7",
"4.0.8",
"4.0.9",
"4.1.0",
"4.1.1"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7xgj-8392-5q4r/GHSA-7xgj-8392-5q4r.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.4.10"
}
]
}
],
"package": {
"name": "fastmcp-slim",
"purl": "pkg:pypi/fastmcp-slim",
"ecosystem": "PyPI"
},
"versions": [
"3.3.0",
"3.3.0b1",
"3.3.0b2",
"3.3.1",
"3.4.0",
"3.4.0b1",
"3.4.1",
"3.4.2",
"3.4.3",
"3.4.4",
"3.4.5",
"3.4.6",
"3.4.7",
"3.4.8",
"3.4.9"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7xgj-8392-5q4r/GHSA-7xgj-8392-5q4r.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.1.2"
}
]
}
],
"package": {
"name": "fastmcp-slim",
"purl": "pkg:pypi/fastmcp-slim",
"ecosystem": "PyPI"
},
"versions": [
"4.0.0",
"4.0.1",
"4.0.10",
"4.0.11",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.6",
"4.0.7",
"4.0.8",
"4.0.9",
"4.1.0",
"4.1.1"
],
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-7xgj-8392-5q4r/GHSA-7xgj-8392-5q4r.json"
}
}
],
"modified": "2026-10-23T21:45:04.921838145Z",
"provider": "osv",
"references": [
"https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r",
"https://github.com/PrefectHQ/fastmcp/pull/5933",
"https://github.com/PrefectHQ/fastmcp/pull/5934",
"https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df",
"https://github.com/PrefectHQ/fastmcp/commit/8649ba5fc91a68568a69729497edeb804a064332",
"https://github.com/PrefectHQ/fastmcp",
"https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.10",
"https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2"
],
"provider_metadata": {
"cwe_ids": [
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": null,
"github_reviewed_at": "2026-10-23T21:32:06Z"
}
},
"related_cves": [],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 427044,
"published_at": "2026-10-23T21:32:06+00:00"
}