FastMCP direct calls skip authorization checks on transformed components
FastMCP: Post-transform component authorization is skipped on direct calls
FastMCP maintainers confirmed and fixed a component authorization bypass vulnerability, changing to perform authentication and authorization on the final transformed tools, resources, templates and prompts in 3.4.10 and 4.1.2. Affected are fastmcp and fastmcp-slim versions 3.0.0 to 3.4.9 and 4.0.0 to 4.1.1. The cause is that the list path applies the transform first and then authorizes the transformed components, whereas the direct lookup path returns the component directly after applying the transform without checking its applicable AuthCheck, so a low-privilege client that knows the component identifier can call a tool denied by policy, or read protected resources and prompts. The reporter reproduced it on 4.1.0 with an in-process server: a caller without the admin scope listed tools as empty, but a direct call returned protected content. The fix also makes a denied specific resource shadow a resource template with the same URI, preventing a proxy template from retrieving the same protected resource from upstream.
The advisory explains which lookup path the bypass occurs on and provides a runnable PoC, so teams deploying FastMCP can use it to check affected versions and temporary mitigations.