A component transform may alter the tool that an MCP caller sees, but authorization still has to apply to the target after transformation. The GitHub reviewed FastMCP advisory identifies a path where direct component calls did not enforce that check. An agent or client reaching a transformed tool could therefore bypass an intended capability restriction…
Inspect the ClaimsCase · DiggingBeagle record
FastMCP direct calls skipped post-transform component authorization
FastMCP accepted certain transformed-component calls without reapplying authorization to the resulting target, according to a reviewed October 20 advisory.
Scope
FastMCP 3.0.0 to before 3.4.10 and 4.0.0 to before 4.1.2; server component transformation and direct invocation.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
CASE-2026-FASTMCP-TRANSFORMED-AUTH: GHSA-7xgj-8392-5q4r reports a post-transform component authorization bypass for direct calls, patched in 3.4.10 and 4.1.2. Evidence comes from SRC-2026-FAST-MCP-AUTH-GHSA. Published technical statements or controlled results are not verified production-loss counts. No impact band is assigned because the observed outcome and its denominator do not establish a comparable severity measure.
Assessed Oct 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-FASTMCP-AUTH-01 · FastMCP GHSA-7xgj-8392-5q4r transformed component authorization bypass
At a glance
A tool hidden from discovery is not necessarily inaccessible. The correct security boundary is an authorization decision on the final resolved object and every concrete effect path, including proxy-template fallthrough.
Read the implicationsThe public advisory does not establish a production exploit campaign.
Limits and uncertaintyFull account
A component transform may alter the tool that an MCP caller sees, but authorization still has to apply to the target after transformation. The GitHub reviewed FastMCP advisory identifies a path where direct component calls did not enforce that check. An agent or client reaching a transformed tool could therefore bypass an intended capability restriction under the advisory's prerequisites. Two maintained release branches were patched, 3.4.10 and 4.1.2. The finding is about an MCP execution boundary, not evidence that all FastMCP deployments expose privileged tools or that a real user was compromised. It also must remain separate from the OAuth issuer-binding bug disclosed under a different advisory.
The security decision belonged after transformation and final component resolution. The vulnerable listing path could correctly conceal a protected tool while a caller naming the component directly still reached the underlying dispatcher without the equivalent authorization check. In an MCP deployment, hiding a capability from discovery only reduces its visibility; it is not access control against a caller that already knows the tool name. This defect concerns what a registered component is allowed to execute, whereas the separate OAuth issuer bug concerns where a client sends authentication material. Maintainer advisory.
Mechanism and trust boundary
- 01
Configure a protected component and transform
A FastMCP server transforms tools, prompts or resources after an authorization policy has already examined the original component.
Boundary: Original component ACL / resolved transformed component
- 02
Request a component directly by known identifier
Direct resolution paths can return the transformed component without a second check, even when discovery omitted it.
Boundary: Tool visibility / direct invocation authorization
- 03
Execute a protected action or retrieve a protected resource
The caller may reach a capability blocked in the advertised listing; overlapping proxy templates can also serve a concrete denied resource.
Boundary: List-time filtering / effect-time server enforcement
Timeline
- 2026-10 (month precision)Event type unspecified
FastMCP transformed-tool ACL bypass disclosed
An upstream advisory identified that direct component lookup could bypass earlier visibility filtering.
- Oct 20, 2026disclosure
Public disclosure
Claims & evidence
CLM-FASTMCP-AUTH-01GHSA-7xgj-8392-5q4r reports a post-transform component authorization bypass for direct calls, patched in 3.4.10 and 4.1.2.supported
Basis: reported finding
- supportsFastMCP GHSA-7xgj-8392-5q4r transformed component authorization bypassprimary disclosure
Description; Affected versions; Patched versions
CLM-FASTMCP-ENRICH-VERSIONSThe maintainer lists affected FastMCP 3.0.0-3.4.9 and 4.0.0-4.1.1, with fixed 3.4.10 and 4.1.2; direct component authorization is checked after transforms in those fixes.supported
Basis: reported finding
- supportsFastMCP GHSA-7xgj-8392-5q4r transformed component authorization bypassprimary disclosure
Affected versions; Maintainer assessment and remediation
Implications
A tool hidden from discovery is not necessarily inaccessible. The correct security boundary is an authorization decision on the final resolved object and every concrete effect path, including proxy-template fallthrough.
Controls and mitigations
- Upgrade affected FastMCP or fastmcp-slim 3.x to 3.4.10 and 4.x to 4.1.2. Until deployment, enforce access at the handler boundary and eliminate proxy-template overlap for protected concrete resources.
Unknowns and contradictions
- The public advisory does not establish a production exploit campaign.
Sources and citation
Material revision history
- Oct 24, 2026 · Canonical change recorded · new in release · revision 188