PyPI/fastmcp CVE-2026-32871: critical 10, EPSS 0.92%

FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

Action: Upgrade fastmcp to 3.2.0 or later.

pip install fastmcp==3.2.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-338
• https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-vv7q-7jx5-f767
• https://nvd.nist.gov/vuln/detail/CVE-2026-32871
• https://github.com/PrefectHQ/fastmcp/pull/3507
• https://github.com/PrefectHQ/fastmcp/commit/40bdfb6b1de0ce30609ee9ba5bb95ecd04a9fb71
• https://github.com/PrefectHQ/fastmcp
• https://github.com/PrefectHQ/fastmcp/releases/tag/v3.2.0
• https://pypi.org/project/fastmcp
• https://github.com/advisories/GHSA-vv7q-7jx5-f767

CVE-2026-32871 · published 2026-06-29T11:50:45.183289Z · modified 2026-07-01T20:22:52.844800Z · JSON