4 matches found
CVE-2026-55096
The fast-mcp-telegram Telegram MCP Server is vulnerable to a Server-Side Request Forgery (SSRF) in versions prior to 30.1 . The send_message and send_message_to_phone tools allow users to provide HTTP(S) URLs for file downloads. The vulnerability exists because the _validate_url_security function...
CVE-2026-55096 SSRF via DNS-resolution gap in _validate_url_security (file download by URL)
fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...
CVE-2026-55096 SSRF via DNS-resolution gap in _validate_url_security (file download by URL)
fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...
CVE-2026-55096 SSRF via DNS-resolution gap in _validate_url_security (file download by URL)
fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...