CVE-2026-27124: jlowin fastmcp

csirt@kutim:~/threat-intel/cve/CVE-2026-27124

CVSS 6.1 · Medium EPSS 0,31%

Kerentanan Unintended Proxy or Intermediary ('Confused Deputy') pada jlowin fastmcp. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

FastMCP is the standard framework for building MCP applications. Prior to version 3.2.0, while testing the GitHubProvider OAuth integration, which allows authentication to a FastMCP MCP server via a FastMCP OAuthProxy using GitHub OAuth, it was discovered that the FastMCP OAuthProxy does not properly validate the user's consent upon receiving the authorization code from GitHub. In combination with GitHub’s behavior of skipping the consent page for previously authorized clients, this introduces a Confused Deputy vulnerability. This issue has been patched in version 3.2.0.

Rincian

Terbit di NVD: 3 April 2026
Terakhir diubah: 24 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
EPSS (30 hari): 0,31% peluang dieksploitasi; lebih tinggi dari 21,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
jlowin	fastmcp	Semua versi sebelum 3.2.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-rww4-4w9c-7733 exploit · mitigasi · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.