fast-mcp-telegram vulnerabilities

2 known vulnerabilities in fast-mcp-telegram from Leshchenko1979. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  fast-mcp-telegram: Incomplete List of Disallowed Inputs

  CVE-2026-55096Sep 28, 2026Leshchenko1979

  fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by _vali

• 9.4 Critical severity

  fast-mcp-telegram: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-52830Jul 2, 2026Leshchenko1979

  fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators