{"items":[{"id":"NVI-00010759","kind":"vulnerability","title":"FastMCP: Post-transform component authorization is skipped on direct calls","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7xgj-8392-5q4r"],"plain_summary":"GitHub lists this reviewed advisory for fastmcp, fastmcp, fastmcp-slim, fastmcp-slim. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-f0363ce8c1585ef1510d6c831247a15b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-23T21:32:07.000Z","value":"6.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-f0363ce8c1585ef1510d6c831247a15b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-f0363ce8c1585ef1510d6c831247a15b","url":"https://github.com/advisories/GHSA-7xgj-8392-5q4r","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7xgj-8392-5q4r","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:08.657Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-f0363ce8c1585ef1510d6c831247a15b"],"technology":"fastmcp","known_exclusions":[],"conditions_summary":"## Maintainer assessment and remediation\n\nThis report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.\n\nThe fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.\n\nAffected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates","public_affected_ranges":[">= 3.0.0, < 3.4.10"]},{"certainty":"source_listed","source_ids":["sr-f0363ce8c1585ef1510d6c831247a15b"],"technology":"fastmcp","known_exclusions":[],"conditions_summary":"## Maintainer assessment and remediation\n\nThis report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.\n\nThe fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.\n\nAffected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates","public_affected_ranges":[">= 4.0.0, < 4.1.2"]},{"certainty":"source_listed","source_ids":["sr-f0363ce8c1585ef1510d6c831247a15b"],"technology":"fastmcp-slim","known_exclusions":[],"conditions_summary":"## Maintainer assessment and remediation\n\nThis report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.\n\nThe fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.\n\nAffected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates","public_affected_ranges":[">= 3.0.0, < 3.4.10"]},{"certainty":"source_listed","source_ids":["sr-f0363ce8c1585ef1510d6c831247a15b"],"technology":"fastmcp-slim","known_exclusions":[],"conditions_summary":"## Maintainer assessment and remediation\n\nThis report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.\n\nThe fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.\n\nAffected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates","public_affected_ranges":[">= 4.0.0, < 4.1.2"]}],"null_published_at":"2026-10-31T22:27:12.380Z","source_updated_at":"2026-10-23T21:32:07.000Z","source_disclosed_at":"2026-10-23T21:32:06.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:08.657Z"}],"next_cursor":null,"snapshot_revision":"42594"}