CVE-2026-52830: fast-mcp-telegram Bearer token path traversal bypasses auth

Vulnerability Overview fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection CVE ID: CVE-2026-52830 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: Low EPSS Score: - Weaknesses: CWE-22, CWE-287 GHSA ID: GHSA-5x42-pcdj-voxm Affected Versions Affected Versions: <= 0.19.0 Patched Version: 0.19.1 Description: When verifying HTTP Bearer tokens, concatenates the raw token string to form the session file path. The validator rejects the exact reserved token but does not reject path separators or canonicalized paths before checking if the session file exists. A remote HTTP client can authenticate using the token for the default legacy session (e.g., ) when the documented session file exists. This vulnerability bypasses the reserved name controls intended to prevent conflicts between Telegram multi-user sessions and the default stdio or legacy sessions. By enabling account-prefixed MCP tools, the attacker can still view and invoke the default account's prefixed tools; therefore, the prefix middleware does not prevent this session selection bypass. Impact: An unauthenticated network client can access the Telegram account represented by the default file without knowing the generated Bearer token, provided a legacy or default session file exists on the server running HTTP authentication. The attacker can invoke Telegram MCP tools, including message reading, message sending, MTProto API calls, and attachment generation tool surfaces, which are available for that account. Technical Details strips whitespace and rejects the exact reserved name: It then appends to the raw token and checks the resulting path: There is no check to reject , , absolute paths, or resolved paths outside the configured session directory. The session client is constructed in the same manner in : Using the default session directory, the token resolves as follows: The exact token is rejected, but the traversal alias reaches the same file and is accepted. This is particularly significant because is the documented default , and security documentation states that reserved names are blocked to prevent conflicts with stdio and HTTP multi-user sessions. The vulnerable code exists in the current main branch: commit 1b7ab765f1c09b21d65c370574f17fe75a478c9 and release tag 0.19.0. Reproduction The following proof uses stub session files and a stub Telegram client, so real Telegram credentials are not required. It verifies the authentication decision and the final session path used by the client builder. Run on the current main branch: The local script creates additional files for verification reference: Why This Crosses Authentication Boundaries Production HTTP authentication deployments expect high-entropy, per-session Bearer tokens. Reserved names are explicitly blocked because common names like could conflict with default sessions. Traversal aliases redirect the public token namespace back to the filesystem namespace, bypassing reserved name controls. Account prefix middleware operates after authentication. It tags tools based on the Telegram account resolved from the token. If a traversal token is accepted as a valid FastMCP access token, the middleware correctly exposes the default account's prefixed tools to the attacker. It cannot recover the lost authentication boundary. Remediation Reject Bearer tokens that are not strictly opaque token identifiers before using them in file paths. Recommended checks: 1. Only accept tokens from a secure alphabet, such as , , or those matching generated URL-safe base64 tokens. 2. Reject , , empty segments, and absolute paths for both HTTP headers and URL authentication. 3. Resolve the final session path and require it to be directly inside the configured session directory: 4. Apply the same validation in , URL authentication middleware, setup flows, cleanup code, and any code that opens session files. 5. Add regression tests for exact reserved names, traversal aliases like , absolute paths, URL-encoded traversal (if any route decodes path components), Windows separators, and normally generated tokens. References GHSA-5x42-pcdj-voxm

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-52830: fast-mcp-telegram Bearer token path traversal bypasses auth

More from this source