Detections
Analytics

SCA: security update for fastmcp (GHSA-vv7q-7jx5-f767)

critical Tenable Cloud Security Plugin ID 439563

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in
 FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class
 is responsible for constructing HTTP requests to the backend service. A vulnerability exists in the
 _build_url() method. When an OpenAPI operation defines path parameters (e.g., /api/v1/users/{user_id}),
 the system directly substitutes parameter values into the URL template string without URL-encoding.
 Subsequently, urllib.parse.urljoin() resolves the final URL. Since urljoin() interprets ../ sequences as
 directory traversal, an attacker controlling a path parameter can perform path traversal attacks to escape
 the intended API prefix and access arbitrary backend endpoints. This results in authenticated SSRF, as
 requests are sent with the authorization headers configured in the MCP provider. This issue has been
 patched in version 3.2.0. (CVE-2026-32871)

Solution

Update the fastmcp library and its related packages to version 3.2.0 or later.

See Also

https://github.com/advisories/GHSA-vv7q-7jx5-f767

Plugin Details

Severity: Critical

ID: 439563

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 4/1/2026

Updated: 7/7/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7

Percentile: 98.3

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-32871

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 10

Threat Score: 10

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/31/2026

Vulnerability Publication Date: 3/31/2026

Reference Information

CVE: CVE-2026-32871

cwe: CWE-918