FastMCP: a transform let denied tools answer a direct call

01What happened

FastMCP maintainers published advisory GHSA-7xgj-8392-5q4r on 20 October 2026, after Rishi Dhupar reported that component authorization was skipped on direct calls. The project shipped fixes the same day in 3.4.10 and 4.1.2. GitHub added the advisory to its database on 23 October, and no CVE has been assigned.

02How it works

A FastMCP server transform can rewrite the metadata that a component's authorization policy reads. On a direct lookup the server checked the policy against the original component, then returned the transformed component without checking it again. A caller who knew a component identifier could therefore invoke a tool, or fetch a resource or prompt, that the policy denies. The advisory adds that a denied concrete resource could also be reached upstream through a matching proxy resource template.

03Who is affected

Servers on fastmcp or fastmcp-slim 3.0.0 through 3.4.9, or 4.0.0 through 4.1.1, that combine server transforms with an authorization policy. Deployments that use no transforms, or define no policy, are not exposed. The reporter reproduced the bypass on 4.1.0 with a caller that lacked the admin scope: the tool was hidden from listing, but a direct call still returned its output.

04What to do

Upgrade to FastMCP 3.4.10 or 4.1.2. Until then the advisory advises enforcing the required authorization at the handler or server boundary, rather than relying on a policy whose inputs a transform can change, and avoiding overlapping proxy templates for protected resources.

Questions people ask

Is FastMCP patched against the post-transform authorization bypass?

FastMCP shipped fixes on 20 October 2026 in versions 3.4.10 and 4.1.2, which authorize the final transformed tools, resources, templates and prompts rather than the originals. The 3.4.10 release notes describe the change as a backport and encourage all 3.x users to upgrade. Both releases also stop a denied concrete resource from being served through a matching resource template.

Which FastMCP versions are affected by GHSA-7xgj-8392-5q4r?

GHSA-7xgj-8392-5q4r lists fastmcp and fastmcp-slim from 3.0.0 up to 3.4.9, and from 4.0.0 up to 4.1.1, as affected. Servers that do not use server transforms, or that define no authorization policy, are not exposed. The reporter reproduced the bypass on version 4.1.0 using a caller that lacked the admin scope.

Does the FastMCP authorization bypass have a CVE?

No CVE is assigned to the FastMCP post-transform authorization bypass. GitHub lists it as GHSA-7xgj-8392-5q4r, rated Moderate with a CVSS v3.1 base score of 6.8, under CWE-862 for missing authorization. Defenders should track the fix through the FastMCP 3.4.10 and 4.1.2 release notes rather than through a CVE identifier.

How was the FastMCP authorization flaw found?

Rishi Dhupar reported the flaw to the FastMCP maintainers, and the advisory credits him as the reporter. His original report states that OpenAI Codex assisted with the static analysis, the proof of concept and the write-up. Dhupar also co-authored the 3.x backport fix in pull request 5934 with maintainer zzstoatzz, as a first-time contributor.

Sources 4 links, all fetched

1. 1github.comFastMCP Advisory
2. 2github.comGitHub Advisory DB
3. 3github.comFastMCP 4.1.2 Release
4. 4github.comFastMCP 3.4.10 Release