Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

prefecthq/fastmcp

              main @ 0949080
            

Fixes

CVEs

CRITICAL

Peak severity

24.2%

Coverage

Highlights

Auth Bypass: 36 prior fixes. Scrutinize any change in this area.

src/fastmcp/server/auth/oauth_proxy.py: most-fixed (6 issues). Treat as high-risk during review.

38 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: The application failed to properly validate OAuth audiences and client IDs against specific resource identifiers, exposing the system to token reuse attacks. The fix required binding token validation specifically to target client IDs and identifier URIs rather than generic Graph endpoints.

Command Injection: Insanitized server names passed to CLI install commands on Windows allowed shell command execution via subprocess.run, leading to CVE-2025-64340 and CVE-2025-62801. This was addressed by restricting names to an input character allowlist.

SSRF: Authenticated path traversal and SSRF (CVE-2026-32871) was caused by improper URL encoding of path parameters in OpenAPI requests, which allowed attackers to request arbitrary backend endpoints via urljoin.