heaven-framework (>=0.1.15, <=0.1.22), oracle-oci-api-mcp-server (>=1.0.0, <=1.0.1) +18 more potentially affected by CVE-2026-32871 via fastmcp (2.12.2)

fastmcp PYPI version 2.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - heaven-framework =0.1.15, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 and more Source...

basic-memory (>=0.16.3, <=0.18.5), idb-mcp (>=0.0.1, <=0.1.2) +10 more potentially affected by CVE-2026-32871 via fastmcp (2.12.3)

fastmcp PYPI version 2.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - basic-memory =0.16.3, =0.0.1, =0.1.0, =3.5.12, =1.0.2, =1.1.1, =1.0.1, =1.0.1, =0.3.0rc0, =0.1.0a32, =0.1.3, =0.1.4 Source cves: CVE-2026-32871...

azpaddypy (0.9.29), basic-memory (>=0.14.1, <=0.14.2) +19 more potentially affected by CVE-2026-32871 via fastmcp (2.9.2)

fastmcp PYPI version 2.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - azpaddypy 0.9.29 - basic-memory =0.14.1, =0.0.22, =0.1.98, =0.8.1, =0.4.0, =0.1.1, =0.1.0, =1.0.0, =2.9.0, =0.1.1, =0.4.24, =1.1.0, =0.2.0, =0.1.3...

agentfetch-mcp (>=1.0.0, <=1.0.1), constitute-mcp (>=0.1.18, <=0.1.27) +31 more potentially affected by CVE-2026-32871 via fastmcp (0.4.1)

fastmcp PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - agentfetch-mcp =1.0.0, =0.1.18, =2.0.2, =1.0.0, =0.1.0, =0.1.41, =1.0.0, =1.0.1 - iflow-mcp-philschmid-code-sandbox-mcp 0.1.0 -...

aiowhitebit-mcp (0.2.7), basic-memory (>=0.14.3, <=0.14.4) +2 more potentially affected by CVE-2026-32871 via fastmcp (2.10.2)

fastmcp PYPI version 2.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aiowhitebit-mcp 0.2.7 - basic-memory =0.14.3, =2.2.0, =0.0.0, =1.0.0 Source cves: CVE-2026-32871 Source advisory: OSV:GHSA-VV7Q-7JX5-F767...

mcp-instana (>=0.1.1, <=0.3.1) potentially affected by CVE-2026-32871 via fastmcp (2.10.3)

fastmcp PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - mcp-instana =0.1.1, =0.3.1 Source cves: CVE-2026-32871 Source advisory: OSV:GHSA-VV7Q-7JX5-F767...

vail-model-registry (>=0.1.11, <=0.1.12) potentially affected by CVE-2026-32871 via fastmcp (2.10.0)

fastmcp PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - vail-model-registry =0.1.11, =0.1.12 Source cves: CVE-2026-32871 Source advisory: OSV:GHSA-VV7Q-7JX5-F767...

alation-ai-agent-mcp (>=0.7.0, <=0.12.0), carton-mcp (>=0.1.80, <=0.1.83) +11 more potentially affected by CVE-2026-32871 via fastmcp (2.9.0)

fastmcp PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - alation-ai-agent-mcp =0.7.0, =0.1.80, =0.1.0, =1.0.17, =0.1.24, =0.1.2, =1.7.1, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2026-32871 Source advisory...

ai-code-review (>=2.0.0.dev1, <=3.1.2), ai-cr (>=2.0.0.dev1, <=3.1.2) +23 more potentially affected by CVE-2026-32871 via fastmcp (2.8.1)

fastmcp PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - ai-code-review =2.0.0.dev1, =2.0.0.dev1, =4.0.0.dev21, =0.0.1, =0.2.0, =2.0.0.dev1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 and more Source...

alibaba-cloud-application-management-mcp-server (>=0.1.0, <=1.0.4), alibaba-cloud-ops-mcp-server (>=0.9.2, <=0.9.27) +19 more potentially affected by CVE-2026-32871 via fastmcp (2.8.0)

fastmcp PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - alibaba-cloud-application-management-mcp-server =0.1.0, =0.9.2, =0.0.1, =0.2.2, =0.2.0, =2.0.5, =2.0.7, =2.0.7, =0.9.8, =2.0.0, =0.2.0, =0.3.0 and...

cnry-mcp-server-qdrant (>=0.0.2, <=0.8.3), mad-mcp-qdrant (>=1.1.3, <=1.9.3) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.7.0)

fastmcp PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - cnry-mcp-server-qdrant =0.0.2, =1.1.3, =0.8.1, =0.8.1.1 - mcp-server-qdrant-openai 0.8.1 Source cves: CVE-2026-32871 Source advisory:...

iflow-mcp-redhat-data-and-ai-template-mcp-server (0.1.0), mcp-server-datahub (>=0.3.0, <=0.3.4) +2 more potentially affected by CVE-2026-32871 via fastmcp (2.10.4)

fastmcp PYPI version 2.10.4 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - iflow-mcp-redhat-data-and-ai-template-mcp-server 0.1.0 - mcp-server-datahub =0.3.0, =0.1.0, =0.2.0 Source cves: CVE-2026-32871 Source advisory:...

aio-tests-mcp (>=0.1.0, <=0.1.2), aiowhitebit-mcp (0.2.5) +4 more potentially affected by CVE-2026-32871 via fastmcp (2.5.1)

fastmcp PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aio-tests-mcp =0.1.0, =0.1.8, =1.0.0, =1.0.78 - iflow-mcp-sean-tate-fastmcp-python-oauth2-with-entra-id 0.1.0 - sakit 11.0.0 Source cves:...

cratedb-mcp (0.0.3), figma-to-compose-mcp (>=0.1.0, <=1.1.1) +7 more potentially affected by CVE-2026-32871 via fastmcp (2.6.1)

fastmcp PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - cratedb-mcp 0.0.3 - figma-to-compose-mcp =0.1.0, =0.1.0, =0.1.0, =0.0.2, =1.0.0, =3.0.0, =3.0.2 Source cves: CVE-2026-32871 Source advisory:...

mcp-server-flockx (0.1.0), tumee-codeguard (>=0.26.0, <=0.26.1) potentially affected by CVE-2026-32871 via fastmcp (2.6.0)

fastmcp PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - mcp-server-flockx 0.1.0 - tumee-codeguard =0.26.0, =0.26.1 Source cves: CVE-2026-32871 Source advisory: OSV:GHSA-VV7Q-7JX5-F767...

aws-athena-mcp (1.0.1), fabric-lakehouse-mcp (>=0.3.1, <=0.3.15) +7 more potentially affected by CVE-2026-32871 via fastmcp (2.5.2)

fastmcp PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - aws-athena-mcp 1.0.1 - fabric-lakehouse-mcp =0.3.1, =0.1.17, =0.32.2, =0.0.1, =0.1.6, =0.1.9 Source cves: CVE-2026-32871 Source advisory:...

iflow-mcp-mariadb-mariadb-server (0.2.3) potentially affected by CVE-2026-27124 via fastmcp (2.12.1)

fastmcp PYPI version 2.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - iflow-mcp-mariadb-mariadb-server 0.2.3 Source cves: CVE-2026-27124 Source advisory: OSV:GHSA-RWW4-4W9C-7733...

agentfetch-mcp (>=1.0.0, <=1.0.1), constitute-mcp (>=0.1.18, <=0.1.27) +31 more potentially affected by CVE-2026-27124 via fastmcp (0.4.1)

fastmcp PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - agentfetch-mcp =1.0.0, =0.1.18, =2.0.2, =1.0.0, =0.1.0, =0.1.41, =1.0.0, =1.0.1 - iflow-mcp-philschmid-code-sandbox-mcp 0.1.0 -...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview fastmcp is a The fast, Pythonic way to build MCP servers and clients. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the OAuthProxy.handleidpcallback function. An attacker can gain unauthorized access to resources associated with...

beads-mcp (>=0.47.2, <=0.49.1), fs-mcp (>=1.6.0, <=1.47.3) +4 more potentially affected by CVE-2026-27124 via fastmcp (2.14.3)

fastmcp PYPI version 2.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on fastmcp and may be impacted: - beads-mcp =0.47.2, =1.6.0, =1.0.0, =1.0.1, =0.2.5, =0.2.6 - zap-ai 0.4.0 Source cves: CVE-2026-27124 Source advisory: OSV:GHSA-RWW4-4W9C-7733...