FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. In combination with GitHub’s behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability. This issue has been patched in version 3.2.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the
    GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP
    OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate
    the user's consent upon receiving the authorization code from GitHub. In combination with GitHub’s
    behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy
    vulnerability. This issue has been patched in version 3.2.0. (CVE-2026-27124)

ID	Name	Product	Family	Type	Severity
458526	Echo: fastmcp: security update to 2.14.5+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
458526	Echo: fastmcp: security update to 2.14.5+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
439576	SCA: security update for fastmcp (GHSA-rww4-4w9c-7733)	Tenable Cloud Security	SCA Checks	Local	high
439576	SCA: security update for fastmcp (GHSA-rww4-4w9c-7733)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-27124

high

Tenable Plugins

high

high

high

high