{"id":"ghsa-ghsa-7xgj-8392-5q4r","seq":661317,"kind":"advisory","title":"FastMCP: Post-transform component authorization is skipped on direct calls","url":"https://github.com/advisories/GHSA-7xgj-8392-5q4r","permalink":"https://vulnpulse.app/items/ghsa-ghsa-7xgj-8392-5q4r","summary":"影響: pip:fastmcp >= 3.0.0, < 3.4.10 → 3.4.10, pip:fastmcp >= 4.0.0, < 4.1.2 → 4.1.2, pip:fastmcp-slim >= 3.0.0, < 3.4.10 → 3.4.10, pip:fastmcp-slim >= 4.0.0, < 4.1.2 → 4.1.2\nMaintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies. The fixes authorize t…","severity":"medium","techs":["python"],"cves":[],"tags":["GHSA-7xgj-8392-5q4r","fastmcp","fastmcp","fastmcp-slim","fastmcp-slim"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T21:32:06.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}