FastMCP Authorization Bypass via Direct Component Calls

FastMCP versions 3.0.0–3.4.9 and 4.0.0–4.1.1 skip post-transform authorization checks on direct component calls, allowing low-privilege users to invoke protected tools, resources, and prompts. The vulnerability affects both fastmcp and fastmcp-slim packages when using component authorization with transforms.

Disclosed 23 October 2026 · Record updated 23 October 2026

Impact

Direct component calls bypass authorization policies, allowing low-privilege callers to access protected behavior without proper authorization checks.

Our coverage

A uniformed guard watches helplessly as someone walks past the velvet rope directly to the vault, bypassing the checkpoint entirely.

Vulnerabilities

FastMCP flaw let low-privilege users call protected tools

PrefectHQ has patched an authorisation bypass in its Model Context Protocol server framework that skipped permission checks on direct component calls.

23 Oct 2026

Sources

github.comhttps://github.com/advisories/GHSA-7xgj-8392-5q4r