FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the backend service. A vulnerability exists in the _build_url() method. When an OpenAPI operation defines path parameters (e.g., /api/v1/users/{user_id}), the system directly substitutes parameter values into the URL template string without URL-encoding. Subsequently, urllib.parse.urljoin() resolves the final URL. Since urljoin() interprets ../ sequences as directory traversal, an attacker controlling a path parameter can perform path traversal attacks to escape the intended API prefix and access arbitrary backend endpoints. This results in authenticated SSRF, as requests are sent with the authorization headers configured in the MCP provider. This issue has been patched in version 3.2.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in
    FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class
    is responsible for constructing HTTP requests to the backend service. A vulnerability exists in the
    _build_url() method. When an OpenAPI operation defines path parameters (e.g., /api/v1/users/{user_id}),
    the system directly substitutes parameter values into the URL template string without URL-encoding.
    Subsequently, urllib.parse.urljoin() resolves the final URL. Since urljoin() interprets ../ sequences as
    directory traversal, an attacker controlling a path parameter can perform path traversal attacks to escape
    the intended API prefix and access arbitrary backend endpoints. This results in authenticated SSRF, as
    requests are sent with the authorization headers configured in the MCP provider. This issue has been
    patched in version 3.2.0. (CVE-2026-32871)

ID	Name	Product	Family	Type	Severity
461382	Echo: fastmcp: security update to 2.14.5+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	critical
461382	Echo: fastmcp: security update to 2.14.5+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
439563	SCA: security update for fastmcp (GHSA-vv7q-7jx5-f767)	Tenable Cloud Security	SCA Checks	Local	critical
439563	SCA: security update for fastmcp (GHSA-vv7q-7jx5-f767)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical

Detections

Analytics

CVE-2026-32871

critical

Tenable Plugins

critical

critical

critical

critical