{"action":"Upgrade fastmcp to 3.4.10 (3.x) or 4.1.2 (4.x) or later.","affected":[{"fixed":"3.4.10","introduced":"3.0.0"},{"fixed":"4.1.2","introduced":"4.0.0"}],"component":"fastmcp","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["3.4.10","4.1.2"],"ghsa_id":"GHSA-7xgj-8392-5q4r","id":"tcs_01M5NCGYJ9KNG2PTHBAYQ3H0HC","modified_at":"2026-10-23T21:45:04.921838145Z","published_at":"2026-10-23T21:32:06Z","references":["https://osv.dev/vulnerability/GHSA-7xgj-8392-5q4r","https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r","https://github.com/PrefectHQ/fastmcp/pull/5933","https://github.com/PrefectHQ/fastmcp/pull/5934","https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df","https://github.com/PrefectHQ/fastmcp/commit/8649ba5fc91a68568a69729497edeb804a064332","https://github.com/PrefectHQ/fastmcp","https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.10","https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-7xgj-8392-5q4r","url":"https://osv.dev/vulnerability/GHSA-7xgj-8392-5q4r"}],"summary":"FastMCP: Post-transform component authorization is skipped on direct calls"}