The root cause of this vulnerability is that the OpenAPIProvider in FastMCP substitutes path parameters into URL templates without URL‑encoding. The unencoded values are then processed by urllib.parse.urljoin, which interprets "../" sequences as directory traversal. An attacker who can control a path parameter can fabricate an OpenAPI request that causes the provider to issue an HTTP request to an arbitrary backend endpoint while preserving the authorization headers configured by the client. This flaw is a classic example of an insecure direct object reference, identified as CWE‑918. The impact is that an authenticated user can reach services or resources outside the intended API prefix, potentially exposing sensitive data or enabling malicious manipulation of internal functionality.

All installations of the PrefectHQ FastMCP library running a version earlier than 3.2.0 are affected. The vulnerability exists in the RequestDirector class of the OpenAPIProvider component, before the patch introduced in version 3.2.0.

The CVSS score of 10 denotes critical severity, indicating that exploitation carries high impact on confidentiality, integrity, and availability of the protected backend systems. The EPSS score is not provided, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Nevertheless, the flaw can be triggered remotely by any authenticated user who can craft an OpenAPI request, making it a significant risk if left unmitigated. The likely attack flow involves sending a malicious path parameter from the client side to force the server to issue an internal request to an unintended endpoint, thereby creating an SSRF condition to the backend services.