PyPI/fastmcp CVE-2026-32871: critical 10, EPSS 1.37%

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

Action: Upgrade fastmcp to 3.2.0 or later.

pip install fastmcp==3.2.0

Affected

Fixed versions

Sources

• osv: GHSA-vv7q-7jx5-f767
• https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vv7q-7jx5-f767
• https://nvd.nist.gov/vuln/detail/CVE-2026-32871
• https://github.com/PrefectHQ/fastmcp/pull/3507
• https://github.com/PrefectHQ/fastmcp/commit/40bdfb6b1de0ce30609ee9ba5bb95ecd04a9fb71
• https://github.com/PrefectHQ/fastmcp
• https://github.com/PrefectHQ/fastmcp/releases/tag/v3.2.0

CVE-2026-32871 · published 2026-03-31T22:53:21Z · modified 2026-09-10T03:50:41.271699069Z · JSON