FastMCP Discloses 14 Security Flaws, Led by a Critical Client RCE From Malicious MCP Servers

Published October 19, 2026 (IST) by the AgentStack News Desk. Facts were checked against the 14 GitHub security advisories in the PrefectHQ/fastmcp repository, the v3.4.8, v3.4.9, v4.0.11, v4.1.0 and v4.1.1 release notes, and the project’s security policy.

FastMCP published 14 security advisories between October 16 and October 18, 2026, and the most serious one lets a malicious MCP server run code on the machine of any FastMCP client that calls its tools. FastMCP is the open-source Python framework from PrefectHQ for building MCP servers and clients, with about 13.6 million PyPI downloads in the past week.

The batch covers one critical flaw, five high, seven moderate, and one low. Beyond the client code execution bug, the list includes authorization bypasses, upstream credential leaks through OpenAPI tools, a Windows installer command injection, and several ways for unauthenticated callers to exhaust a server.

The fix path is short: run FastMCP 3.4.9 on the 3.x line or 4.1.1 on the 4.x line, since those two releases cover all 14 advisories. This report draws on the advisory list, the v4.1.1 release notes, and the project’s security policy, per our editorial standards.

What FastMCP Disclosed Between October 16 and 18

The FastMCP maintainers published 13 advisories on October 16 and a fourteenth on October 18, all in the project’s GitHub repository. Outside researchers are credited on 13 of them, and each advisory lists affected and patched versions for the 3.x and 4.x lines, which are the only supported release lines.

Advisory	Severity	What breaks	Fixed in 3.x	Fixed in 4.x
GHSA-gpgx-58w2-xwwf	Critical	Client runs code from a server-supplied tool output schema	3.4.8	4.0.11
GHSA-mhwm-p596-p7q4	High (CVSS 8.1)	ToolInjectionMiddleware skips per-tool scope checks	3.4.8	4.0.11
GHSA-57vm-5fr9-3r5x	High	Windows command injection in claude-code and gemini-cli installers	3.4.8	4.0.11
GHSA-2qh8-g8rv-3mx5	High	Unbounded CIMD caches in OAuthProxy	3.4.8	4.0.0b4
GHSA-p8g9-xjch-9mxg	High	Each unknown JWT key ID triggers a JWKS fetch	3.4.9	4.1.0
GHSA-cg3c-5×66-h9cc	High (CVSS 7.5)	Caller regex can block a worker	3.4.9	4.1.1
GHSA-qvjc-pw7p-hvg5	Moderate	Undeclared OpenAPI arguments override upstream credentials	3.4.8	4.0.11
GHSA-m2xc-hx3h-rjf6	Moderate (CVSS 6.1)	Cookie header forwarded to OpenAPI backends	3.4.8	Not listed
GHSA-99xm-8q53-5c8p	Moderate	OpenAPI path value of two dots reaches other backend routes	3.4.9	4.1.0
GHSA-6868-q46w-rmjv	Moderate	Host and Origin protection silently off on SSE	3.4.8	4.0.11
GHSA-63pr-7fpf-v477	Moderate (CVSS 6.5)	Component manager routes skip auth by default	3.4.8	4.0.11
GHSA-c3q8-4mcq-p7vg	Moderate	Hashed app tool names bypass visibility rules	3.4.8	4.0.11
GHSA-76mv-6cmh-q7fj	Moderate	MultiAuth merges state across token sources	Not affected	4.1.0
GHSA-pwp3-fpg3-p53c	Low	Symlinked SKILL.md read outside its skill folder	3.4.9	4.1.0

The timeline matters for patch audits. FastMCP 3.4.8 and 4.0.11 shipped fixes for nine of the 14 issues on October 4 under release notes that said all users should upgrade. The advisories went public 12 days after those releases, so teams that apply patch releases promptly already had the fix for the critical client flaw and most of the others.

The rest arrived later. FastMCP 4.1.0 on October 8 carried the JWKS, MultiAuth, dot-segment, and skill fixes for 4.x, 3.4.9 backported them to 3.x on October 16, and 4.1.1 closed the regex issue on October 18.

How the Critical Client RCE Works

The critical advisory targets the FastMCP client, the side that connects to MCP servers. An MCP server can declare a tool output schema whose self-referencing title holds Python code. When a FastMCP client calls that tool and parses a successful structured result, the client evaluates the title and runs the code with its own process privileges.

The advisory traces the bug to one branch of the client’s JSON Schema type converter. For a $ref pointing at the schema root, the converter passed the untrusted title straight into a Python ForwardRef, which Pydantic then evaluated. Every other ForwardRef call in the same file sanitized the name first.

# Shape of the malicious schema described in GHSA-gpgx-58w2-xwwf (payload elided)
{
  "type": "object",
  "title": "SafeRoot",
  "properties": {
    "check": {"anyOf": [{"$ref": "#", "title": "<python expression>"}, {"type": "string"}]}
  },
  "required": ["check"]
}

A successful exploit leaves no visible error, because the exception handler around the conversion only logs and the tool call returns normally. The trigger is any tool result with non-empty structured content and no error flag, which is the normal success path for typed tools.

The advisory also flags the same converter on server-controlled form elicitation schemas as a path to assess separately. The affected range starts at FastMCP 2.10.0 and runs through 3.4.7 on the 3.x line and 4.0.10 on the 4.x line.

Authorization Bypasses and Credential Leaks

Four advisories break FastMCP’s own access rules on the server side. The highest rated, at CVSS 8.1, involves ToolInjectionMiddleware: tools injected through it skipped the per-tool scope rule, so a client holding a low-privilege token could list and call a tool that required an admin scope it did not have.

The component manager advisory covers a contrib module that adds HTTP routes to turn tools, resources, and prompts on or off. With required_scopes left at its default of None, those routes were attached with no authentication middleware, even on servers whose MCP endpoint required tokens.

from fastmcp.contrib.component_manager import set_up_component_manager

# Vulnerable before 3.4.8 / 4.0.11: routes attached without auth
set_up_component_manager(server=mcp)

# Pass scopes explicitly so the routes sit behind the server's auth
set_up_component_manager(server=mcp, required_scopes=["admin"])

Two more bypass visibility controls. Hashed FastMCPApp tool names stayed callable after an operator disabled or hid the tool, and MultiAuth on 4.x could merge sessions, tasks, and request state across two token sources that issue the same client ID.

Three advisories hit the OpenAPI provider, which turns REST operations into MCP tools. Callers could add undeclared header, cookie, or query arguments that replaced the upstream API key the operator configured, the provider forwarded the Cookie header to the backend, and a path value of two dots reached other backend routes, an incomplete fix for CVE-2026-32871.

For teams that wrap internal REST APIs as MCP tools, the OpenAPI bugs mean an MCP caller could act upstream with an identity or route the operator never granted. Our agent integration platforms guide covers managed options that keep upstream credentials out of the agent’s reach.

Denial of Service, Installer and Transport Flaws

Three high-severity advisories let callers exhaust a FastMCP server. A JWT carrying a random key ID made the verifier refetch the identity provider’s whole JWKS on every request, before any signature check, so one inbound request meant one outbound request. OAuthProxy’s CIMD caches had no size limit and could grow without bound.

The CIMD flaw sits in a feature that is on by default for every OAuthProxy-based provider, including the GitHub, Google, Auth0, WorkOS, Azure, and AWS providers. The regex advisory covers RegexSearchTransform, whose generated search_tools tool compiled a caller’s pattern with Python’s backtracking engine on the event loop thread.

FastMCP 4.1.1 now rejects regex patterns longer than 1,000 characters and stops a search after about a second. FastMCP 3.4.9 moves the same search to Pydantic’s regex engine with a time budget.

The installer advisory reopens CVE-2025-64340. The earlier fix validated only the server name, while the claude-code and gemini-cli installers still passed dependencies, the entrypoint, and environment values from a project’s fastmcp.json into a Windows shell. On Windows, running the install command on a downloaded project could execute commands hidden in its config file.

The SSE advisory found that host_origin_protection=True was silently ignored on the SSE transport, leaving loopback servers open to DNS rebinding from a web page. The low-severity skills advisory let a symlinked SKILL.md expose files outside its skill folder.

Which FastMCP Versions Fix All 14 Advisories

FastMCP 3.4.9 and FastMCP 4.1.1 are the first releases that carry fixes for every advisory in this batch on their respective lines. Anything older on 3.x or 4.x misses at least one fix, and the earliest affected releases for the critical client bug go back to 2.10.0.

Projects still on FastMCP 2.x have no patched release, since the security policy marks 2.x as unsupported and the critical client flaw affects 2.10.0 onward. Those projects need a migration to 3.4.9 or later.

# 4.x line
pip install --upgrade "fastmcp>=4.1.1"

# 3.x line, staying on 3.x
pip install --upgrade "fastmcp>=3.4.9,<4"

# Confirm what your environment actually loads
python -c "import fastmcp; print(fastmcp.__version__)"

The advisories cover the standalone fastmcp package and, for the regex issue, fastmcp-slim. The FastMCP security policy lists flaws in the MCP SDK itself as out of scope, and the official MCP Python SDK advisory page tracks its own recent fixes, including one where an OAuth client could send credentials to an authorization server chosen by the MCP server.

Why Server Metadata Is Now Untrusted Input

Most MCP security work so far has focused on servers: exposed tools, weak auth, and injected prompts that steer an agent. This batch adds the reverse direction, where a server attacks the client through the metadata the protocol asks clients to trust, such as tool output schemas, elicitation forms, and OAuth discovery documents.

Our ToFu report counted 253 bugs across 118 MCP servers, and agents now connect to third-party servers listed in public directories at runtime. Any client library that turns server-supplied schemas into code paths needs the same input hardening that web frameworks apply to request bodies.

Gateways help on both sides. Our MCP gateways guide and Red Hat MCP gateway report cover products that broker tool traffic, log calls, and restrict which servers an agent can reach, which shrinks the set of servers a vulnerable client ever talks to.

What MCP Teams Should Do This Week

The upgrade covers the code, though a short audit of how each FastMCP deployment is configured catches the cases where an older release is still running somewhere. These steps follow directly from the preconditions listed in the 14 advisories and the patched versions on each one.

• Inventory: find every service, agent, and CI job that imports fastmcp, including transitive installs, and record the version.
• Upgrade: move 4.x to 4.1.1 and 3.x to 3.4.9, then migrate any 2.x project to a supported line.
• Client exposure: list the MCP servers each FastMCP client connects to and drop untrusted ones until the upgrade lands.
• Component manager: search for set_up_component_manager calls without required_scopes.
• OpenAPI tools: review which upstream credentials sit on the OpenAPI HTTP client and rotate them if untrusted callers had access.
• Windows installs: check that no one ran the claude-code or gemini-cli install commands on an untrusted fastmcp.json.

For incident handling after a suspected compromise, the NIST, NSA and CISA incident practices we covered on October 18 give a usable order: preserve logs, revoke credentials the process touched, and rebuild from a known-good image.

Patching FastMCP closes these specific advisories, but it does not control which tools an agent may call. Our 10 best MCP security tools guide compares the gateways and scanners that add tool access policies and runtime inspection on top of your MCP servers.

Teams that want a policy layer in front of FastMCP servers can start with our MintMCP vs Runlayer vs Lasso comparison, which covers tool scanning, request and response inspection, and self-hosted versus managed deployment.

If you deploy FastMCP servers remotely, our MCP hosting platforms comparison covers Prefect’s FastMCP Gateway alongside Cloudflare Workers, Vercel, Cloud Run, and other hosts.

Patching FastMCP closes these specific flaws, and runtime monitoring catches the next class of them. Our AI agent security tools guide compares 12 platforms that watch agent tool calls in production.

Patching one library is a fix, and a governance program is the system that catches the next one. Our AI agent governance buyer’s guide lays out agent inventories, policy as code, and audit requirements.

Patching a library closes one hole. Our Zenity vs Noma vs Pillar Security comparison compares three platforms that monitor agents and their tool connections for the next one.

Frequently Asked Questions

The Bottom Line

FastMCP’s 14 advisories are fixed in 3.4.9 and 4.1.1, and most fixes have been available since October 4. The critical client flaw is the one to prioritize, since any FastMCP client that connects to an untrusted MCP server could run that server’s code. Teams still on 2.x have no patch and need to migrate.

We will update this story if CVE IDs are assigned or the maintainers publish further fixes. Send corrections through our contact page.

Related coverage: MCP, Agent security, MCP explained, MCP servers for enterprise teams, MCP server security bugs, and MCP gateways.