FastMCP post-transform component authorization bypass

Severity: medium · CVSS 6.8 · Published 2026-10-23

FastMCP is a library for building AI-powered tool interfaces with access control policies. When a server transforms component metadata before checking authorization, a direct call can bypass the policy check and grant access to protected tools, resources, and prompts that should be denied to the caller. An attacker with valid low-privilege credentials can exploit this to execute hidden administrative functions or retrieve protected data.

Technologies: fastmcp (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.8, published 23 October 2026.
Which products and versions are affected?
Prefect FastMCP 3.0.0–3.4.9, 4.0.0–4.1.1; Prefect FastMCP-slim 3.0.0–3.4.9, 4.0.0–4.1.1; fastmcp (PyPI) >= 3.0.0, < 3.4.10, ECOSYSTEM:introduced=3.0.0,fixed=3.4.10; fastmcp-slim (PyPI) >= 3.0.0, < 3.4.10, ECOSYSTEM:introduced=3.0.0,fixed=3.4.10.
Is there a fix for This vulnerability?
Yes. fastmcp (PyPI): upgrade to 3.4.10 or later; fastmcp-slim (PyPI): upgrade to 3.4.10 or later. Until then: Until upgrading, avoid overlapping proxy templates for protected resources and enforce authorization at the handler or server boundary rather than relying on policies whose inputs are changed by transforms. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run Prefect FastMCP, Prefect FastMCP-slim, fastmcp (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fastmcp (PyPI): upgrade to 3.4.10 or later
    pip install "fastmcp>=3.4.10"
  • fastmcp-slim (PyPI): upgrade to 3.4.10 or later
    pip install "fastmcp-slim>=3.4.10"

Until upgrading, avoid overlapping proxy templates for protected resources and enforce authorization at the handler or server boundary rather than relying on policies whose inputs are changed by transforms.

Technical details

The vulnerability occurs in direct component lookup paths (tools/call, resources, templates, prompts) where transforms are applied before the final authorization check. The `server.py` code applies metadata transforms and returns the transformed component without re-authorizing it, while the listing path correctly authorizes after transformation. An attacker with a valid low-privilege identity can directly invoke a component by name if they know the transformed name, bypassing the original component's `AuthCheck` policy. The fix applies authorization to the final transformed component in all direct resolution paths.

Affected products

  • Prefect FastMCP 3.0.0–3.4.9, 4.0.0–4.1.1
  • Prefect FastMCP-slim 3.0.0–3.4.9, 4.0.0–4.1.1

Timeline

  • 2026-10-23: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.