CVE-2026-32871: FastMCP OpenAPIProvider SSRF Vulnerability

CVE-2026-32871 Overview

CVE-2026-32871 is a critical Server-Side Request Forgery (SSRF) vulnerability in FastMCP, a Python library for building MCP (Model Context Protocol) servers and clients. The vulnerability exists in the _build_url() method within the RequestDirector class of the OpenAPIProvider component. When processing OpenAPI specifications that define path parameters, the system fails to properly URL-encode parameter values before constructing HTTP requests, allowing attackers to inject directory traversal sequences and escape intended API prefixes.

Critical Impact

Attackers can exploit this path traversal flaw to perform authenticated SSRF attacks, accessing arbitrary backend endpoints with the authorization headers configured in the MCP provider, potentially leading to unauthorized data access or further exploitation of internal services.

Affected Products

• FastMCP versions prior to 3.2.0
• Applications using OpenAPIProvider with user-controllable path parameters
• MCP servers exposing internal APIs through FastMCP's OpenAPI integration

Discovery Timeline

• 2026-04-02 - CVE CVE-2026-32871 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-32871

Vulnerability Analysis

The vulnerability resides in FastMCP's OpenAPIProvider component, specifically within the RequestDirector class that handles HTTP request construction for backend API calls. When an OpenAPI specification defines operations with path parameters (e.g., /api/v1/users/{user_id}), the _build_url() method directly substitutes user-supplied parameter values into the URL template string without performing URL-encoding.

The core issue arises from the subsequent use of urllib.parse.urljoin() to resolve the final URL. Python's urljoin() function interprets ../ sequences as directory traversal instructions, treating them as legitimate path navigation rather than literal string values. This behavior, combined with the lack of input sanitization, creates an exploitable path traversal condition.

An attacker who controls a path parameter value can inject sequences like ../../../internal-api/admin to escape the intended API prefix (e.g., /api/v1/users/) and construct requests to arbitrary endpoints on the backend server. Since these requests are sent with the authorization headers configured in the MCP provider, this constitutes an authenticated SSRF vulnerability with significant impact potential.

Root Cause

The root cause is improper input validation and insufficient URL encoding in the _build_url() method. The method fails to sanitize or encode path parameter values before string interpolation, and Python's urllib.parse.urljoin() function inherently processes ../ sequences as path traversal. This combination allows user-controlled input to manipulate the final request destination, violating the principle that user input should never directly influence request routing without proper validation and encoding.

Attack Vector

This vulnerability is exploitable over the network by any attacker who can supply values for path parameters in API operations exposed through FastMCP's OpenAPIProvider. The attack requires no authentication to the FastMCP layer itself, though the SSRF requests will carry whatever authentication credentials are configured in the provider. An attacker would craft malicious parameter values containing ../ sequences to traverse out of the expected API path and target internal endpoints, potentially accessing sensitive resources, administrative interfaces, or cloud metadata services that would otherwise be unreachable.

Detection Methods for CVE-2026-32871

Indicators of Compromise

• HTTP request logs showing path parameters containing ../ sequences or URL-encoded equivalents (%2e%2e%2f)
• Backend access logs revealing requests to unexpected endpoints originating from the MCP server
• Unusual patterns of internal API access from the FastMCP service account
• Authentication token usage on endpoints outside the expected API scope

Detection Strategies

• Implement web application firewall rules to detect and block path traversal patterns in API parameters
• Monitor application logs for RequestDirector activity with suspicious path parameter values
• Deploy network-level monitoring to detect unexpected internal service communications from MCP components
• Use runtime application self-protection (RASP) solutions to identify path manipulation attempts

Monitoring Recommendations

• Enable verbose logging for the OpenAPIProvider component to capture all URL construction activity
• Set up alerts for any 4xx or 5xx responses from endpoints outside the configured API prefix
• Monitor outbound network connections from FastMCP services for connections to internal IP ranges or cloud metadata endpoints
• Implement audit logging for all requests processed by the RequestDirector class

How to Mitigate CVE-2026-32871

Immediate Actions Required

• Upgrade FastMCP to version 3.2.0 or later immediately
• Audit existing OpenAPI specifications for operations with path parameters that accept user input
• Review backend access logs for evidence of exploitation attempts
• Consider implementing additional input validation at the application layer as defense-in-depth

Patch Information

The vulnerability has been addressed in FastMCP version 3.2.0. The fix, implemented in commit 40bdfb6b1de0ce30609ee9ba5bb95ecd04a9fb71, properly URL-encodes path parameter values before URL construction, preventing path traversal sequences from being interpreted by urljoin(). Users should upgrade via pip: pip install fastmcp>=3.2.0. For more details, see the GitHub Security Advisory GHSA-vv7q-7jx5-f767 and the v3.2.0 release notes.

Workarounds

• Implement input validation at the application layer to reject path parameters containing ../, ..\\, or URL-encoded traversal sequences
• Deploy a reverse proxy or web application firewall in front of the MCP server to filter malicious requests
• Restrict network egress from the FastMCP service to only explicitly required backend endpoints
• If possible, avoid exposing OpenAPI operations with user-controllable path parameters until the upgrade is complete