[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fastmcp	3.4.7 → 3.4.10

---

FastMCP: Post-transform component authorization is skipped on direct calls

GHSA-7xgj-8392-5q4r

More information

Details

Maintainer assessment and remediation

This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.

The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.

Affected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both fastmcp and fastmcp-slim installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates.

Fixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform.

Original report

Post-transform component authorization is skipped on direct calls

Summary

FastMCP's direct component paths can return a transformed component before its applicable AuthCheck, allowing low-privilege callers to execute hidden protected behavior. I reproduced this against FastMCP 4.1.0 and commit e2fcc412001ff7414095c5dc282f94c70299a612 using only an in-process FastMCP server. The attacker does not have server-side access and does not control FastMCP configuration.

Details

Attacker prerequisites

A server uses a supported provider, server, or session transform and a metadata-aware component AuthCheck. The attacker has a valid low-privilege identity, lacks the required scope, and knows or guesses the final transformed component name. They do not control the transform or the policy.

Root cause

Listing applies transforms and then authorizes the transformed component. In the direct lookup path, FastMCP 4.1.0 applies the transform and returns the component without authorizing that final component. See server.py:933-940. The MCP tools/call handler reaches this path; equivalent direct paths exist for resources, templates, and prompts.

Proof of concept

Save this as poc_transform_auth.py:

import anyio

from fastmcp import FastMCP
from fastmcp.server.auth import restrict_tag
from fastmcp.server.transforms.tool_transform import ToolTransform
from fastmcp.tools.base import Tool
from fastmcp.tools.tool_transform import ToolTransformConfig

async def main() -> None:
    server = FastMCP("auth-boundary")
    server.add_tool(
        Tool.from_function(
            lambda: "PROTECTED SECRET",
            name="tagged_tool",
            tags={"public"},
            auth=restrict_tag("admin", scopes=["admin"]),
        )
    )
    server.add_transform(
        ToolTransform({"tagged_tool": ToolTransformConfig(tags={"admin"})})
    )

    print("listed:", [tool.name for tool in await server.list_tools()])
    try:
        result = await server.call_tool("tagged_tool")
    except Exception as exc:
        print("BLOCKED:", type(exc).__name__)
    else:
        print("VULNERABLE: direct call returned", result.content[0].text)

anyio.run(main)

Run it in an isolated environment:

uv run --with fastmcp==4.1.0 -- python poc_transform_auth.py

Observed on 4.1.0 for a caller without the admin scope:

listed: []
VULNERABLE: direct call returned PROTECTED SECRET

Impact

A low-privilege caller can directly execute administrative tools hidden from listing, including their side effects and returned secrets. The same ordering flaw can expose protected resources, templates, or prompts.

Recommended remediation

Apply component authorization to the final transformed component in every direct resolution/execution path, after all provider, server, and session transforms. Reuse one ordered resolver for list and direct operations so lookup never returns a transformed component before its applicable AuthCheck runs.

AI assistance

Yes — OpenAI Codex assisted static analysis/PoC/writeup; reproduction was validated against stated version.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r
• https://github.com/PrefectHQ/fastmcp/pull/5933
• https://github.com/PrefectHQ/fastmcp/pull/5934
• https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df
• https://github.com/PrefectHQ/fastmcp/commit/8649ba5fc91a68568a69729497edeb804a064332
• https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.10
• https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2
• https://github.com/advisories/GHSA-7xgj-8392-5q4r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

PrefectHQ/fastmcp (fastmcp)

v3.4.10: : Back in Check

Compare Source

This release backports component authorization checks after transforms and prevents denied concrete resources from being served by matching templates. All 3.x users are encouraged to upgrade. Thanks to our 2 contributors, including 1 first-time contributor.

What's Changed

Security 🔒

• Backport authorization of transformed components and prevent denied-resource template fallback by @​zzstoatzz and @​rishid in #​5934

New Contributors

• @​rishid made their first contribution in #​5934

Full Changelog: PrefectHQ/fastmcp@v3.4.9...v3.4.10

v3.4.9: : Contain Yourself

Compare Source

This release backports security fixes from 4.1: OpenAPI path parameters reject . and .. segments, a skill's SKILL.md must stay inside its skill folder, regex tool search is bounded in time and pattern length, and JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID. All 3.x users are encouraged to upgrade. Thanks to our 6 contributors, including 3 first-time contributors.

What's Changed

Security 🔒

• [3.x] Backport OpenAPI dot-segment and skill containment fixes by @​zzstoatzz, @​GEONWOOHAN, and @​avrlab233 in #​5765
• [3.x] Bound regex tool search with Pydantic's regex engine and a time budget by @​zzstoatzz and @​SAYUTIM in #​5768

Fixes 🐞

• [3.x] Share JWKS refreshes across key lookups by @​zzstoatzz and @​YuvalElbar6 in #​5769

Docs 📚

• docs: credit contributors in v3.4.8 changelog entries by @​jlowin in #​5450
• docs: add v3.4.9 changelog entries by @​zzstoatzz in #​5772

New Contributors

• @​avrlab233 made their first contribution in #​5765
• @​SAYUTIM made their first contribution in #​5768
• @​YuvalElbar6 made their first contribution in #​5769

Full Changelog: PrefectHQ/fastmcp@v3.4.8...v3.4.9

v3.4.8: : Long Arm of the Patch

Compare Source

This release contains important security and bug fixes. All users are encouraged to upgrade. Thanks to our 2 contributors.

What's Changed

Security 🔒

• [3.x] Apply Host/Origin protection settings to the SSE transport by @​jlowin in #​5428
• [3.x] Exclude Cookie from forwarded HTTP headers by @​jlowin in #​5429
• [3.x] Pass client CLI arguments literally to Windows .cmd wrappers by @​jlowin and @​strawgate in #​5420
• [3.x] Use the server's auth provider for component manager routes by @​jlowin and @​strawgate in #​5426
• [3.x] Bound CIMD cache growth by @​jlowin in #​5430
• [3.x] Include resource metadata in component manager auth challenges by @​jlowin in #​5435
• [3.x] Apply transforms, enabled state, and auth to hashed tool lookups by @​jlowin and @​strawgate in #​5416
• [3.x] Build client schema types with create_model and bounded caches by @​jlowin and @​strawgate in #​5414
• [3.x] Keep $ref pointers when inlining would produce an oversized schema by @​jlowin and @​strawgate in #​5422
• [3.x] Resolve injected tools through the server's tool lookup by @​jlowin in #​5432
• [3.x] Require a startup-URL session for the fastmcp dev apps preview by @​jlowin and @​strawgate in #​5418
• [3.x] Inline schemas whose pointers pass through alias definitions by @​jlowin and @​strawgate in #​5439
• [3.x] OpenAPI components send only declared arguments and keep configured headers by @​jlowin and @​strawgate in #​5424

Docs 📚

• docs: add v3.4.8 changelog entries by @​jlowin in #​5445

Full Changelog: PrefectHQ/fastmcp@v3.4.7...v3.4.8

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud