Log in Start free

Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M

CVE-2026-32871FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

High 8.5

In plain English

A high-severity server-side request forgery in fastmcp from PrefectHQ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High
Exploit odds (30 days)0.9%top 39.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A vulnerability exists in the _build_url() method. When an OpenAPI operation defines path parameters (e.g., /api/v1/users/{user_id}), the system directly substitutes parameter values into the URL template string without URL-encoding. Subsequently, urllib.parse.urljoin() resolves the final URL. Since urljoin() interprets ../ sequences as directory traversal, an attacker controlling a path parameter can perform path traversal attacks to escape the intended API prefix and access arbitrary backend endpoints. This results in authenticated SSRF, as requests are sent with the authorization headers configured in the MCP provider. This issue has been patched in version 3.2.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIfastmcp3.2.0GHSA-vv7q-7jx5-f767
PyPIfastmcp3.2.0PYSEC-2026-338

Affected products (as reported)

VendorProductVersions
PrefectHQ fastmcp < 3.2.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

References