Evidence · DiggingBeagle record
FastMCP GHSA-7xgj-8392-5q4r transformed component authorization bypass
- Source role
- primary disclosure
Evidence record
Claim-level citations (2)
- supportsFastMCP direct calls skipped post-transform component authorization: GHSA-7xgj-8392-5q4r reports a post-transform component authorization bypass for direct calls, patched in 3.4.10 and 4.1.2.
Description; Affected versions; Patched versions
- supportsFastMCP direct calls skipped post-transform component authorization: The maintainer lists affected FastMCP 3.0.0-3.4.9 and 4.0.0-4.1.1, with fixed 3.4.10 and 4.1.2; direct component authorization is checked after transforms in those fixes.
Affected versions; Maintainer assessment and remediation