FastMCP: Post-transform component authorization is skipped on direct calls

影響: pip:fastmcp >= 3.0.0, < 3.4.10 → 3.4.10, pip:fastmcp >= 4.0.0, < 4.1.2 → 4.1.2, pip:fastmcp-slim >= 3.0.0, < 3.4.10 → 3.4.10, pip:fastmcp-slim >= 4.0.0, < 4.1.2 → 4.1.2

Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies. The fixes authorize t…

GitHub Advisory Databaseで読む

2026/10/24 06:32、GitHub Advisory Databaseが「FastMCP: Post-transform component authorization is skipped on direct calls」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。