CVE-2026-55096

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...

EUVD-2026-88377

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...

CVE-2026-55096: Incomplete List of Disallowed Inputs

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the sendmessage/sendmessagetophone MCP tools accept files as a list of https URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by validateurlsecurity, an SSRF denylist that check...