Skip to content

deps(mcp): update dependency fastmcp to v3.4.10 [security] - #8839

Merged
khvn26 merged 2 commits into
mainfrom
renovate/pypi-fastmcp-vulnerability
Nov 5, 2026
Merged

deps(mcp): update dependency fastmcp to v3.4.10 [security]#8839
khvn26 merged 2 commits into
mainfrom
renovate/pypi-fastmcp-vulnerability

Conversation

@flagsmith-engineering

@flagsmith-engineering flagsmith-engineering Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
fastmcp 3.4.7 → 3.4.10 age confidence

FastMCP: Post-transform component authorization is skipped on direct calls

GHSA-7xgj-8392-5q4r

More information

Details

Maintainer assessment and remediation

This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.

The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.

Affected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both fastmcp and fastmcp-slim installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates.

Fixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform.

Original report
Post-transform component authorization is skipped on direct calls
Summary

FastMCP's direct component paths can return a transformed component before its applicable AuthCheck, allowing low-privilege callers to execute hidden protected behavior. I reproduced this against FastMCP 4.1.0 and commit e2fcc412001ff7414095c5dc282f94c70299a612 using only an in-process FastMCP server. The attacker does not have server-side access and does not control FastMCP configuration.

Details
Attacker prerequisites

A server uses a supported provider, server, or session transform and a metadata-aware component AuthCheck. The attacker has a valid low-privilege identity, lacks the required scope, and knows or guesses the final transformed component name. They do not control the transform or the policy.

Root cause

Listing applies transforms and then authorizes the transformed component. In the direct lookup path, FastMCP 4.1.0 applies the transform and returns the component without authorizing that final component. See server.py:933-940. The MCP tools/call handler reaches this path; equivalent direct paths exist for resources, templates, and prompts.

Proof of concept

Save this as poc_transform_auth.py:

import anyio

from fastmcp import FastMCP
from fastmcp.server.auth import restrict_tag
from fastmcp.server.transforms.tool_transform import ToolTransform
from fastmcp.tools.base import Tool
from fastmcp.tools.tool_transform import ToolTransformConfig

async def main() -> None:
    server = FastMCP("auth-boundary")
    server.add_tool(
        Tool.from_function(
            lambda: "PROTECTED SECRET",
            name="tagged_tool",
            tags={"public"},
            auth=restrict_tag("admin", scopes=["admin"]),
        )
    )
    server.add_transform(
        ToolTransform({"tagged_tool": ToolTransformConfig(tags={"admin"})})
    )

    print("listed:", [tool.name for tool in await server.list_tools()])
    try:
        result = await server.call_tool("tagged_tool")
    except Exception as exc:
        print("BLOCKED:", type(exc).__name__)
    else:
        print("VULNERABLE: direct call returned", result.content[0].text)

anyio.run(main)

Run it in an isolated environment:

uv run --with fastmcp==4.1.0 -- python poc_transform_auth.py

Observed on 4.1.0 for a caller without the admin scope:

listed: []
VULNERABLE: direct call returned PROTECTED SECRET
Impact

A low-privilege caller can directly execute administrative tools hidden from listing, including their side effects and returned secrets. The same ordering flaw can expose protected resources, templates, or prompts.

Recommended remediation

Apply component authorization to the final transformed component in every direct resolution/execution path, after all provider, server, and session transforms. Reuse one ordered resolver for list and direct operations so lookup never returns a transformed component before its applicable AuthCheck runs.

AI assistance

Yes — OpenAI Codex assisted static analysis/PoC/writeup; reproduction was validated against stated version.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

FastMCP: Post-transform component authorization is skipped on direct calls

GHSA-7xgj-8392-5q4r

More information

Details

Maintainer assessment and remediation

This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.

The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.

Affected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both fastmcp and fastmcp-slim installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates.

Fixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform.

Original report
Post-transform component authorization is skipped on direct calls
Summary

FastMCP's direct component paths can return a transformed component before its applicable AuthCheck, allowing low-privilege callers to execute hidden protected behavior. I reproduced this against FastMCP 4.1.0 and commit e2fcc412001ff7414095c5dc282f94c70299a612 using only an in-process FastMCP server. The attacker does not have server-side access and does not control FastMCP configuration.

Details
Attacker prerequisites

A server uses a supported provider, server, or session transform and a metadata-aware component AuthCheck. The attacker has a valid low-privilege identity, lacks the required scope, and knows or guesses the final transformed component name. They do not control the transform or the policy.

Root cause

Listing applies transforms and then authorizes the transformed component. In the direct lookup path, FastMCP 4.1.0 applies the transform and returns the component without authorizing that final component. See server.py:933-940. The MCP tools/call handler reaches this path; equivalent direct paths exist for resources, templates, and prompts.

Proof of concept

Save this as poc_transform_auth.py:

import anyio

from fastmcp import FastMCP
from fastmcp.server.auth import restrict_tag
from fastmcp.server.transforms.tool_transform import ToolTransform
from fastmcp.tools.base import Tool
from fastmcp.tools.tool_transform import ToolTransformConfig

async def main() -> None:
    server = FastMCP("auth-boundary")
    server.add_tool(
        Tool.from_function(
            lambda: "PROTECTED SECRET",
            name="tagged_tool",
            tags={"public"},
            auth=restrict_tag("admin", scopes=["admin"]),
        )
    )
    server.add_transform(
        ToolTransform({"tagged_tool": ToolTransformConfig(tags={"admin"})})
    )

    print("listed:", [tool.name for tool in await server.list_tools()])
    try:
        result = await server.call_tool("tagged_tool")
    except Exception as exc:
        print("BLOCKED:", type(exc).__name__)
    else:
        print("VULNERABLE: direct call returned", result.content[0].text)

anyio.run(main)

Run it in an isolated environment:

uv run --with fastmcp==4.1.0 -- python poc_transform_auth.py

Observed on 4.1.0 for a caller without the admin scope:

listed: []
VULNERABLE: direct call returned PROTECTED SECRET
Impact

A low-privilege caller can directly execute administrative tools hidden from listing, including their side effects and returned secrets. The same ordering flaw can expose protected resources, templates, or prompts.

Recommended remediation

Apply component authorization to the final transformed component in every direct resolution/execution path, after all provider, server, and session transforms. Reuse one ordered resolver for list and direct operations so lookup never returns a transformed component before its applicable AuthCheck runs.

AI assistance

Yes — OpenAI Codex assisted static analysis/PoC/writeup; reproduction was validated against stated version.

Severity

  • CVSS Score: 6.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

PrefectHQ/fastmcp (fastmcp)

v3.4.10: : Back in Check

Compare Source

This release backports component authorization checks after transforms and prevents denied concrete resources from being served by matching templates. All 3.x users are encouraged to upgrade. Thanks to our 2 contributors, including 1 first-time contributor.

What's Changed

Security 🔒

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.9...v3.4.10

v3.4.9: : Contain Yourself

Compare Source

This release backports security fixes from 4.1: OpenAPI path parameters reject . and .. segments, a skill's SKILL.md must stay inside its skill folder, regex tool search is bounded in time and pattern length, and JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID. All 3.x users are encouraged to upgrade. Thanks to our 6 contributors, including 3 first-time contributors.

What's Changed

Security 🔒
Fixes 🐞
Docs 📚

New Contributors

Full Changelog: PrefectHQ/fastmcp@v3.4.8...v3.4.9

v3.4.8: : Long Arm of the Patch

Compare Source

This release contains important security and bug fixes. All users are encouraged to upgrade. Thanks to our 2 contributors.

What's Changed

Security 🔒
Docs 📚

Full Changelog: PrefectHQ/fastmcp@v3.4.7...v3.4.8

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@flagsmith-engineering
flagsmith-engineering Bot requested a review from a team as a code owner October 24, 2026 03:20
@vercel

vercel Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments
Project Deployment Actions Updated
docs Ignored Ignored Preview Nov 3, 2026 3:13am UTC
flagsmith-frontend-preview Ignored Ignored Preview Nov 3, 2026 3:13am UTC
flagsmith-frontend-staging Ignored Ignored Preview Nov 3, 2026 3:13am UTC

Request Review

@flagsmith-engineering flagsmith-engineering Bot added dependencies Pull requests that update a dependency file mcp labels Oct 24, 2026
@flagsmith-engineering
flagsmith-engineering Bot requested review from khvn26 and removed request for a team October 24, 2026 03:20
@coderabbitai

coderabbitai Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: d768c0a2-f858-479a-8700-d33e70466f84

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

CodeRabbit Verify

  • Run CodeRabbit Verify to test the changes in this pull request.

@github-actions

github-actions Bot commented Oct 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
✅ oss · depot-ubuntu-latest-arm-16 — run #22812 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  36.5 seconds
commit  7f97630
info  🔄 Run: #22812 (attempt 1)

🗂️ Previous results
✅ oss · depot-ubuntu-latest-arm-16 — run #22811 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  3 passed

Details

stats  3 tests across 3 suites
duration  35.4 seconds
commit  3790104
info  🔄 Run: #22811 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22811 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  34 seconds
commit  3790104
info  🔄 Run: #22811 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22812 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  32.3 seconds
commit  7f97630
info  🔄 Run: #22812 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #22779 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  35.9 seconds
commit  f3e7ee3
info  🔄 Run: #22779 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22779 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  2 passed

Details

stats  2 tests across 2 suites
duration  32.5 seconds
commit  f3e7ee3
info  🔄 Run: #22779 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #22770 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  36.2 seconds
commit  bf0939d
info  🔄 Run: #22770 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22770 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  31.9 seconds
commit  bf0939d
info  🔄 Run: #22770 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22730 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  33.6 seconds
commit  31d4d4d
info  🔄 Run: #22730 (attempt 1)

✅ oss · depot-ubuntu-latest-arm-16 — run #22730 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  21 passed
skipped  1 skipped

Details

stats  22 tests across 14 suites
duration  1 minute, 8 seconds
commit  31d4d4d
info  🔄 Run: #22730 (attempt 1)

Skipped tests

firefox › tests/onboarding-tests.pw.ts › Onboarding › New user connects via the single-page onboarding flow @oss

✅ oss · depot-ubuntu-latest-arm-16 — run #22711 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-arm-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  36.2 seconds
commit  4efdf51
info  🔄 Run: #22711 (attempt 1)

✅ oss · depot-ubuntu-latest-16 — run #22711 (attempt 1)

Playwright Test Results (oss - depot-ubuntu-latest-16)

passed  1 passed

Details

stats  1 test across 1 suite
duration  32.4 seconds
commit  4efdf51
info  🔄 Run: #22711 (attempt 1)

@flagsmith-engineering
flagsmith-engineering Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch 4 times, most recently from bf0939d to f3e7ee3 Compare October 31, 2026 03:13
@flagsmith-engineering
flagsmith-engineering Bot force-pushed the renovate/pypi-fastmcp-vulnerability branch from f3e7ee3 to 3790104 Compare November 3, 2026 03:13
@github-actions github-actions Bot added the api Issue related to the REST API label Nov 3, 2026
@codecov

codecov Bot commented Nov 3, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.88%. Comparing base (cdec0d3) to head (7f97630).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #8839   +/-   ##
=======================================
  Coverage   98.88%   98.88%           
=======================================
  Files        1690     1690           
  Lines       70891    70891           
=======================================
  Hits        70104    70104           
  Misses        787      787

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@flagsmith-engineering

flagsmith-engineering Bot commented Nov 4, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@khvn26
khvn26 merged commit 362733f into main Nov 5, 2026
41 checks passed
@khvn26
khvn26 deleted the renovate/pypi-fastmcp-vulnerability branch November 5, 2026 09:44
@flagsmith-engineering flagsmith-engineering Bot mentioned this pull request Nov 5, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@khvn26 khvn26 khvn26 approved these changes

Assignees

No one assigned

Labels

api Issue related to the REST API dependencies Pull requests that update a dependency file mcp

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@khvn26