# GHSA-7xgj-8392-5q4r: FastMCP: Post-transform component authorization is skipped on direct calls


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 23 Oct 2026

## What is GHSA-7xgj-8392-5q4r?

GHSA-7xgj-8392-5q4r is a vulnerability in fastmcp, published on 23 Oct 2026. 

### Official description

## Maintainer assessment and remediation

This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the transformed component without rechecking its policy. A client that knows the component identifier can invoke a tool or retrieve a resource or prompt that the configured policy denies.

The fixes authorize the final transformed tools, resources, templates, and prompts. A denied concrete resource also shadows a matching resource template at its URI, preventing proxy templates from retrieving the same protected resource upstream. Authorized callers, authorized component versions, and templates for genuinely absent concrete resources remain supported.

Affected stable release lines: FastMCP 3.0.0–3.4.9 and 4.0.0–4.1.1. The missing final authorization check is present in v3.0.0 history and was reproduced on v3.4.9 and v4.1.0. Both `fastmcp` and `fastmcp-slim` installations are affected when using component authorization with transforms or protected concrete resources overlapping proxy templates.

Fixes are available in FastMCP 3.4.10 and 4.1.2. Until upgrading, avoid overlapping proxy templates for protected resources and enforce the required authorization at the handler or server boundary rather than relying on a policy whose inputs are changed by a transform.

## Original report

# Post-transform component authorization is skipped on direct calls

## Summary

FastMCP's direct component paths can return a transformed component before its applicable `AuthCheck`, allowing low-privilege callers to execute hidden protected behavior. I reproduced this against FastMCP 4.1.0 and commit `e2fcc412001ff7414095c5dc282f94c70299a612` using only an in-process FastMCP server. The attacker does not have server-side access and does not control FastMCP configuration.

## Details

### Attacker prerequisites

A server uses a supported provider, server, or session transform and a metadata-aware component `AuthCheck`. The attacker has a valid low-privilege identity, lacks the required scope, and knows or guesses the final transformed component name. They do not control the transform or the policy.

### Root cause

Listing applies transforms and then authorizes the transformed component. In the direct lookup path, FastMCP 4.1.0 applies the transform and returns the component without authorizing that final component. See [`server.py:933-940`](https://github.com/PrefectHQ/fastmcp/blob/v4.1.0/fastmcp_slim/fastmcp/server/server.py#L933-L940). The MCP `tools/call` handler reaches this path; equivalent direct paths exist for resources, templates, and prompts.

## Proof of concept

Save this as `poc_transform_auth.py`:

```python
import anyio

from fastmcp import FastMCP
from fastmcp.server.auth import restrict_tag
from fastmcp.server.transforms.tool_transform import ToolTransform
from fastmcp.tools.base import Tool
from fastmcp.tools.tool_transform import ToolTransformConfig

async def main() -> None:
    server = FastMCP("auth-boundary")
    server.add_tool(
        Tool.from_function(
            lambda: "PROTECTED SECRET",
            name="tagged_tool",
            tags={"public"},
            auth=restrict_tag("admin", scopes=["admin"]),
        )
    )
    server.add_transform(
        ToolTransform({"tagged_tool": ToolTransformConfig(tags={"admin"})})
    )

    print("listed:", [tool.name for tool in await server.list_tools()])
    try:
        result = await server.call_tool("tagged_tool")
    except Exception as exc:
        print("BLOCKED:", type(exc).__name__)
    else:
        print("VULNERABLE: direct call returned", result.content[0].text)

anyio.run(main)
```

Run it in an isolated environment:

```bash
uv run --with fastmcp==4.1.0 -- python poc_transform_auth.py
```

Observed on 4.1.0 for a caller without the `admin` scope:

```text
listed: []
VULNERABLE: direct call returned PROTECTED SECRET
```

## Impact

A low-privilege caller can directly execute administrative tools hidden from listing, including their side effects and returned secrets. The same ordering flaw can expose protected resources, templates, or prompts.

### Recommended remediation

Apply component authorization to the final transformed component in every direct resolution/execution path, after all provider, server, and session transforms. Reuse one ordered resolver for list and direct operations so lookup never returns a transformed component before its applicable `AuthCheck` runs.

## AI assistance

Yes — OpenAI Codex assisted static analysis/PoC/writeup; reproduction was validated against stated version.

## Which versions are affected by GHSA-7xgj-8392-5q4r?

8 open source packages ship an affected version, including fastmcp and fastmcp-slim.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `fastmcp` | PyPI | From 3.0.0 | 3.4.10 |
| `fastmcp` | PyPI | From 3.0.0 | 3.4.10 |
| `fastmcp` | PyPI | From 4.0.0 | 4.1.2 |
| `fastmcp` | PyPI | From 4.0.0 | 4.1.2 |
| `fastmcp-slim` | PyPI | From 3.0.0 | 3.4.10 |
| `fastmcp-slim` | PyPI | From 3.0.0 | 3.4.10 |
| `fastmcp-slim` | PyPI | From 4.0.0 | 4.1.2 |
| `fastmcp-slim` | PyPI | From 4.0.0 | 4.1.2 |

## How do I fix GHSA-7xgj-8392-5q4r?

Upgrade fastmcp to a fixed version for your release line: 3.4.10 or 4.1.2.

## Is GHSA-7xgj-8392-5q4r being exploited?

There is no known exploitation of GHSA-7xgj-8392-5q4r in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-7xgj-8392-5q4r and fix it if it is affected.

What it is: GHSA-7xgj-8392-5q4r is a vulnerability in fastmcp, published on 23 Oct 2026. 
Exploitation: There is no known exploitation of GHSA-7xgj-8392-5q4r in the wild and no public exploit code.

Affected packages and fixed versions:
- fastmcp (PyPI): affected from 3.0.0; fixed in 3.4.10
- fastmcp (PyPI): affected from 3.0.0; fixed in 3.4.10
- fastmcp (PyPI): affected from 4.0.0; fixed in 4.1.2
- fastmcp (PyPI): affected from 4.0.0; fixed in 4.1.2
- fastmcp-slim (PyPI): affected from 3.0.0; fixed in 3.4.10
- fastmcp-slim (PyPI): affected from 3.0.0; fixed in 3.4.10
- fastmcp-slim (PyPI): affected from 4.0.0; fixed in 4.1.2
- fastmcp-slim (PyPI): affected from 4.0.0; fixed in 4.1.2

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-7xgj-8392-5q4r/ (Markdown: https://insights.sbomify.com/GHSA-7xgj-8392-5q4r/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-7xgj-8392-5q4r

---
From sbomify Insights: https://insights.sbomify.com/GHSA-7xgj-8392-5q4r/
Summaries are generated and may contain mistakes; the official description above is the record.