{"action":"Upgrade fastmcp-slim to 3.4.10 (3.x) or 4.1.2 (4.x) or later.","affected":[{"fixed":"3.4.10","introduced":"3.0.0"},{"fixed":"4.1.2","introduced":"4.0.0"}],"component":"fastmcp-slim","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["3.4.10","4.1.2"],"ghsa_id":"GHSA-7xgj-8392-5q4r","id":"tcs_01M5NCGYW7FGZRDFMBCS3ZRWT3","modified_at":"2026-10-23T21:45:04.921838145Z","published_at":"2026-10-23T21:32:06Z","references":["https://osv.dev/vulnerability/GHSA-7xgj-8392-5q4r","https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r","https://github.com/PrefectHQ/fastmcp/pull/5933","https://github.com/PrefectHQ/fastmcp/pull/5934","https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df","https://github.com/PrefectHQ/fastmcp/commit/8649ba5fc91a68568a69729497edeb804a064332","https://github.com/PrefectHQ/fastmcp","https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.10","https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-7xgj-8392-5q4r#PyPI/fastmcp-slim","url":"https://osv.dev/vulnerability/GHSA-7xgj-8392-5q4r"}],"summary":"FastMCP: Post-transform component authorization is skipped on direct calls"}