FastMCP

Exploited or KEV-listed · 0

Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.

No record for FastMCP has confirmed exploitation or a KEV flag.

Disclosed CVEs, no confirmed exploitation · 10

1. closed
   FastMCP GHSA-7xgj-8392-5q4r: FastMCP post-transform component authorization bypass

   Disclosed · since 23 Oct 2026

   AI
2. closed
   FastMCP GHSA-vqqp-x5qm-5qp4: FastMCP OAuth client provider issuer binding vulnerability

   Disclosed · since 23 Oct 2026

   AI
3. closed10.0
   FastMCP CVE-2026-32871: FastMCP OpenAPI Provider SSRF and Path Traversal

   Disclosed · since 31 Mar 2026 · CVE-2026-32871

   AI
4. closed6.7
   FastMCP CVE-2025-64340: FastMCP Command Injection via Server Names

   Disclosed · since 31 Mar 2026 · CVE-2025-64340

   AI
5. closed8.2
   FastMCP CVE-2026-27124: FastMCP OAuth Proxy Lacks Consent Verification

   Disclosed · since 31 Mar 2026 · CVE-2026-27124

   AI
6. closed7.4
   FastMCP CVE-2025-69196: FastMCP OAuth Proxy Token Reuse

   Disclosed · since 16 Mar 2026 · CVE-2025-69196

   AI
7. closed
   FastMCP FastMCP auth integration confused deputy issue

   Disclosed · since 29 Oct 2025

   AI
8. closed5.4
   FastMCP CVE-2025-62801: FastMCP command injection in Cursor installer

   Disclosed · since 29 Oct 2025 · CVE-2025-62801

   AI
9. closed5.3
   FastMCP CVE-2025-62800: FastMCP reflected XSS in oauth callback page

   Disclosed · since 29 Oct 2025 · CVE-2025-62800

   AI
10. closed8.7
    MCP SDKs CVE-2025-53366: MCP Python SDK FastMCP Server Denial of Service Vulnerability

    Disclosed · since 4 Jul 2025 · CVE-2025-53366

    AI