PyPI/fast-mcp-telegram CVE-2026-52830: critical 9.4, EPSS 0.65%

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

Action: Upgrade fast-mcp-telegram to 0.19.1 or later.

pip install fast-mcp-telegram==0.19.1

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2473
• https://github.com/leshchenko1979/fast-mcp-telegram/security/advisories/GHSA-rxw2-pc8j-vxwm
• https://github.com/leshchenko1979/fast-mcp-telegram
• https://pypi.org/project/fast-mcp-telegram
• https://github.com/advisories/GHSA-rxw2-pc8j-vxwm
• https://nvd.nist.gov/vuln/detail/CVE-2026-52830

CVE-2026-52830 · published 2026-07-13T15:46:27.565228Z · modified 2026-07-13T16:31:55.165460679Z · JSON