{
  "ticket_id": "CVE-2026-32871",
  "code_root": "external/fastmcp",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2026-32871",
    "advisory_id": "GHSA-vv7q-7jx5-f767",
    "advisory_url": "https://github.com/jlowin/fastmcp/security/advisories/GHSA-vv7q-7jx5-f767",
    "vendor": "jlowin",
    "product": "FastMCP",
    "repo": "https://github.com/jlowin/fastmcp"
  },
  "facts": {
    "cve_id": "CVE-2026-32871",
    "advisory_id": "GHSA-vv7q-7jx5-f767",
    "issue_summary": "Path traversal leading to authenticated SSRF in FastMCP's OpenAPIProvider. The OpenAPIProvider parses an OpenAPI spec and exposes the described backend endpoints to MCP clients. The RequestDirector class builds the outbound HTTP request; its _build_url() method joins a client-supplied path parameter onto the configured backend base URL without rejecting path-traversal sequences. A client passing '../' segments in a path parameter escapes the intended API prefix and reaches arbitrary endpoints on the backend host, with the provider's configured Authorization headers attached.",
    "vulnerability_type": "Path Traversal -> Authenticated SSRF",
    "suspected_cwe": ["CWE-22", "CWE-918"],
    "affected_versions": "< 3.2.0",
    "fixed_versions": ["3.2.0"],
    "reproduce_version": "the latest release prior to 3.2.0 (the 3.1.x line; resolve the exact version from PyPI)",
    "verify_fixed_version": "3.2.0",
    "repo_url": "https://github.com/jlowin/fastmcp.git",
    "code_root": "external/fastmcp",
    "ecosystem": "pip",
    "package": "fastmcp",
    "affected_component": "fastmcp OpenAPIProvider -> RequestDirector._build_url()",
    "install_recipe": "pip install 'fastmcp<3.2.0' (vulnerable) or pip install fastmcp==3.2.0 (fixed) in a venv. The published PyPI wheel is the canonical artifact; the GitHub repo at the matching tag is equivalent.",
    "attacker_access": "Any MCP client that can supply a path parameter to an OpenAPIProvider-backed tool.",
    "exploit_outline": "Stand up an OpenAPIProvider against a backend whose OpenAPI spec defines an endpoint with a path parameter. Invoke the generated tool with a path parameter value containing '../' traversal sequences so _build_url() resolves outside the intended API prefix; observe the outbound request hit an unintended backend path.",
    "vulnerable_indicator": "On a version < 3.2.0, the crafted path parameter makes the request escape the configured API prefix and reach an attacker-chosen backend endpoint (observable as a request to the unintended path / a response from it).",
    "fixed_indicator": "On 3.2.0, _build_url() rejects or normalizes the traversal so the request stays within the configured API prefix.",
    "reproduction_requirements": "Python (maintained version) plus the fastmcp package. A small local HTTP backend (e.g. a stub server with an OpenAPI spec) is sufficient; no external services, database, or special infrastructure required.",
    "notes": "The fix is the 3.2.0 release. Reproduce on the newest pre-3.2.0 release and verify the fix on 3.2.0."
  }
}