CVE-2026-32871
Published: 02 April 2026
Summary
CVE-2026-32871 is a critical-severity SSRF (CWE-918) vulnerability in Jlowin Fastmcp. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Protocol-Specific Risks risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring validation and sanitization of path parameters to block directory traversal sequences like '../' before URL construction.
Enforces boundary protection to monitor and control requests to backend endpoints, limiting SSRF exploitation to arbitrary internal services.
Implements information flow enforcement policies to restrict requests to only intended API prefixes, preventing escape to unauthorized backend endpoints.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables unauthenticated remote exploitation of a public-facing OpenAPI provider via unencoded path parameters leading to directory traversal and SSRF against arbitrary backend endpoints, directly facilitating T1190: Exploit Public-Facing Application.
NVD Description
FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP exposes internal APIs to MCP clients by parsing OpenAPI specifications. The RequestDirector class is responsible for constructing HTTP requests to the…
more
backend service. A vulnerability exists in the _build_url() method. When an OpenAPI operation defines path parameters (e.g., /api/v1/users/{user_id}), the system directly substitutes parameter values into the URL template string without URL-encoding. Subsequently, urllib.parse.urljoin() resolves the final URL. Since urljoin() interprets ../ sequences as directory traversal, an attacker controlling a path parameter can perform path traversal attacks to escape the intended API prefix and access arbitrary backend endpoints. This results in authenticated SSRF, as requests are sent with the authorization headers configured in the MCP provider. This issue has been patched in version 3.2.0.
Deeper analysisAI
CVE-2026-32871 affects FastMCP, a Python library for building MCP servers and clients, specifically versions prior to 3.2.0. The vulnerability resides in the OpenAPIProvider component, which parses OpenAPI specifications to expose internal APIs to MCP clients. In the RequestDirector class's _build_url() method, path parameters (e.g., {user_id} in /api/v1/users/{user_id}) are directly substituted into URL templates without URL-encoding. The subsequent use of urllib.parse.urljoin() interprets ../ sequences as directory traversal, enabling attackers to escape the intended API prefix and target arbitrary backend endpoints.
Any network-accessible MCP client can exploit this vulnerability with low complexity and no privileges required (CVSS 10.0: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). By controlling a path parameter, an attacker injects traversal sequences like ../ to redirect requests, resulting in authenticated server-side request forgery (SSRF, CWE-918). Requests carry the authorization headers configured in the MCP provider, allowing access to internal services that would otherwise be restricted.
The issue was addressed in FastMCP version 3.2.0, as detailed in the project's GitHub security advisory (GHSA-vv7q-7jx5-f767), release notes, associated pull request #3507, and patch commit 40bdfb6b1de0ce30609ee9ba5bb95ecd04a9fb71. Security practitioners should upgrade to 3.2.0 or later to mitigate the risk.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Protocol-Specific Risks
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: mcp, mcp, mcp