[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
fastmcp	==3.4.3 → ==3.4.10

---

FastMCP: Post-transform component authorization is skipped on direct calls

GHSA-7xgj-8392-5q4r

More information

Details

Maintainer assessment and remediation

This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.

The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.

Affected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both fastmcp and fastmcp-slim installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates.

Fixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform.

Original report

Post-transform component authorization is skipped on direct calls

Summary

FastMCP's direct component paths can return a transformed component before its applicable AuthCheck, allowing low-privilege callers to execute hidden protected behavior. I reproduced this against FastMCP 4.1.0 and commit e2fcc412001ff7414095c5dc282f94c70299a612 using only an in-process FastMCP server. The attacker does not have server-side access and does not control FastMCP configuration.

Details

Attacker prerequisites

A server uses a supported provider, server, or session transform and a metadata-aware component AuthCheck. The attacker has a valid low-privilege identity, lacks the required scope, and knows or guesses the final transformed component name. They do not control the transform or the policy.

Root cause

Listing applies transforms and then authorizes the transformed component. In the direct lookup path, FastMCP 4.1.0 applies the transform and returns the component without authorizing that final component. See server.py:933-940. The MCP tools/call handler reaches this path; equivalent direct paths exist for resources, templates, and prompts.

Proof of concept

Save this as poc_transform_auth.py:

import anyio

from fastmcp import FastMCP
from fastmcp.server.auth import restrict_tag
from fastmcp.server.transforms.tool_transform import ToolTransform
from fastmcp.tools.base import Tool
from fastmcp.tools.tool_transform import ToolTransformConfig

async def main() -> None:
    server = FastMCP("auth-boundary")
    server.add_tool(
        Tool.from_function(
            lambda: "PROTECTED SECRET",
            name="tagged_tool",
            tags={"public"},
            auth=restrict_tag("admin", scopes=["admin"]),
        )
    )
    server.add_transform(
        ToolTransform({"tagged_tool": ToolTransformConfig(tags={"admin"})})
    )

    print("listed:", [tool.name for tool in await server.list_tools()])
    try:
        result = await server.call_tool("tagged_tool")
    except Exception as exc:
        print("BLOCKED:", type(exc).__name__)
    else:
        print("VULNERABLE: direct call returned", result.content[0].text)

anyio.run(main)

Run it in an isolated environment:

uv run --with fastmcp==4.1.0 -- python poc_transform_auth.py

Observed on 4.1.0 for a caller without the admin scope:

listed: []
VULNERABLE: direct call returned PROTECTED SECRET

Impact

A low-privilege caller can directly execute administrative tools hidden from listing, including their side effects and returned secrets. The same ordering flaw can expose protected resources, templates, or prompts.

Recommended remediation

Apply component authorization to the final transformed component in every direct resolution/execution path, after all provider, server, and session transforms. Reuse one ordered resolver for list and direct operations so lookup never returns a transformed component before its applicable AuthCheck runs.

AI assistance

Yes — OpenAI Codex assisted static analysis/PoC/writeup; reproduction was validated against stated version.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r
• https://github.com/PrefectHQ/fastmcp/pull/5933
• https://github.com/PrefectHQ/fastmcp/pull/5934
• https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df
• https://github.com/PrefectHQ/fastmcp/commit/8649ba5fc91a68568a69729497edeb804a064332
• https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.10
• https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2
• https://github.com/advisories/GHSA-7xgj-8392-5q4r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

PrefectHQ/fastmcp (fastmcp)

v3.4.10: : Back in Check

Compare Source

This release backports component authorization checks after transforms and prevents denied concrete resources from being served by matching templates. All 3.x users are encouraged to upgrade. Thanks to our 2 contributors, including 1 first-time contributor.

What's Changed

Security 🔒

• Backport authorization of transformed components and prevent denied-resource template fallback by @​zzstoatzz and @​rishid in #​5934

New Contributors

• @​rishid made their first contribution in #​5934

Full Changelog: PrefectHQ/fastmcp@v3.4.9...v3.4.10

v3.4.9: : Contain Yourself

Compare Source

This release backports security fixes from 4.1: OpenAPI path parameters reject . and .. segments, a skill's SKILL.md must stay inside its skill folder, regex tool search is bounded in time and pattern length, and JWT verifiers share JWKS refreshes instead of fetching on every unknown key ID. All 3.x users are encouraged to upgrade. Thanks to our 6 contributors, including 3 first-time contributors.

What's Changed

Security 🔒

• [3.x] Backport OpenAPI dot-segment and skill containment fixes by @​zzstoatzz, @​GEONWOOHAN, and @​avrlab233 in #​5765
• [3.x] Bound regex tool search with Pydantic's regex engine and a time budget by @​zzstoatzz and @​SAYUTIM in #​5768

Fixes 🐞

• [3.x] Share JWKS refreshes across key lookups by @​zzstoatzz and @​YuvalElbar6 in #​5769

Docs 📚

• docs: credit contributors in v3.4.8 changelog entries by @​jlowin in #​5450
• docs: add v3.4.9 changelog entries by @​zzstoatzz in #​5772

New Contributors

• @​avrlab233 made their first contribution in #​5765
• @​SAYUTIM made their first contribution in #​5768
• @​YuvalElbar6 made their first contribution in #​5769

Full Changelog: PrefectHQ/fastmcp@v3.4.8...v3.4.9

v3.4.8: : Long Arm of the Patch

Compare Source

This release contains important security and bug fixes. All users are encouraged to upgrade. Thanks to our 2 contributors.

What's Changed

Security 🔒

• [3.x] Apply Host/Origin protection settings to the SSE transport by @​jlowin in #​5428
• [3.x] Exclude Cookie from forwarded HTTP headers by @​jlowin in #​5429
• [3.x] Pass client CLI arguments literally to Windows .cmd wrappers by @​jlowin and @​strawgate in #​5420
• [3.x] Use the server's auth provider for component manager routes by @​jlowin and @​strawgate in #​5426
• [3.x] Bound CIMD cache growth by @​jlowin in #​5430
• [3.x] Include resource metadata in component manager auth challenges by @​jlowin in #​5435
• [3.x] Apply transforms, enabled state, and auth to hashed tool lookups by @​jlowin and @​strawgate in #​5416
• [3.x] Build client schema types with create_model and bounded caches by @​jlowin and @​strawgate in #​5414
• [3.x] Keep $ref pointers when inlining would produce an oversized schema by @​jlowin and @​strawgate in #​5422
• [3.x] Resolve injected tools through the server's tool lookup by @​jlowin in #​5432
• [3.x] Require a startup-URL session for the fastmcp dev apps preview by @​jlowin and @​strawgate in #​5418
• [3.x] Inline schemas whose pointers pass through alias definitions by @​jlowin and @​strawgate in #​5439
• [3.x] OpenAPI components send only declared arguments and keep configured headers by @​jlowin and @​strawgate in #​5424

Docs 📚

• docs: add v3.4.8 changelog entries by @​jlowin in #​5445

Full Changelog: PrefectHQ/fastmcp@v3.4.7...v3.4.8

v3.4.7: : Know Your Audience

Compare Source

FastMCP 3.4.7 restores CIMD private_key_jwt authentication for OAuthProxy deployments at a bare origin. Client assertions are now validated against the exact token endpoint advertised in authorization server metadata, eliminating the doubled-slash audience mismatch.

What's Changed

Security 🔒

• Backport CIMD assertion audience fix to v3 by @​jlowin in #​4799

Docs 📚

• Docs: add v3.4.7 changelog entries by @​jlowin in #​4810

Full Changelog: PrefectHQ/fastmcp@v3.4.6...v3.4.7

v3.4.6: : Trust, but Proxy

Compare Source

FastMCP 3.4.6 backports trusted-proxy support for SSRF-protected OAuth metadata and JWKS fetches. Deployments can now route these requests through a mandated corporate proxy while preserving custom CA certificates; FastMCP refuses the fetch when no proxy is configured instead of risking an unprotected direct request.

What's Changed

Fixes 🐞

• Backport #​4412 to 3.x: support trusted SSRF proxies by @​jlowin in #​4755

Docs 📚

• Docs: add v3.4.6 changelog entries by @​jlowin in #​4761

Full Changelog: PrefectHQ/fastmcp@v3.4.5...v3.4.6

v3.4.5: : Key Change

Compare Source

FastMCP 3.4.5 collects five fixes for the 3.x line. The one that prompted it: a single Ed25519 key in a JWKS — which Rauthy, Ory Hydra, and some Keycloak configurations publish by default — made JWTVerifier reject every token, including ones correctly signed by supported keys in the same set.

What's Changed

Fixes 🐞

• Backport #​4517 to release/3.x: skip unsupported JWKS keys (#​4515) by @​kakiii in #​4631
• Backport #​4469 to release/3.x: fix Azure scope fallback by @​jlowin in #​4662
• Backport #​4523 to release/3.x: serialize deep object query parameters by @​jlowin in #​4664
• Backport #​4564 to release/3.x: make transformed tool required order deterministic by @​jlowin in #​4665
• Backport #​4492 to release/3.x: don't mutate the caller's schema in compress_schema by @​jlowin in #​4663

Docs 📚

• Docs: add v3.4.5 changelog entries by @​jlowin in #​4673

New Contributors

• @​kakiii made their first contribution in #​4631

Full Changelog: PrefectHQ/fastmcp@v3.4.4...v3.4.5

v3.4.4: : Host in Translation

Compare Source

FastMCP 3.4.4 restores HTTP deployment compatibility after the 3.4.3 Host/Origin guard changed default behavior for existing ASGI, serverless, and reverse-proxy deployments. The guard implementation remains available for deployments that opt in with explicit trusted hosts and origins, while 3.x returns to accepting traffic that worked before the patch. This release also adds Hugging Face OAuth provider support, with docs and examples for public and private apps, PKCE, Dynamic Client Registration, and CIMD.

What's Changed

Enhancements ✨

• Hugging Face Auth Integration by @​evalstate in #​4385

Fixes 🐞

• Relax host origin guard defaults by @​jlowin in #​4439
• Restore HTTP host guard compatibility by @​jlowin in #​4472

Docs 📚

• Docs: add v3.4.4 changelog entries by @​jlowin in #​4473

New Contributors

• @​evalstate made their first contribution in #​4385

Full Changelog: PrefectHQ/fastmcp@v3.4.3...v3.4.4

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[gemini-code-assist]

Code Review

This pull request updates the fastmcp dependency from version 3.4.3 to 3.4.10 in pyproject.toml and updates the corresponding dependency locks in uv.lock. There are no review comments, and I have no feedback to provide.