The FastMCP OpenAPIProvider creates URLs for backend requests by inserting path parameters directly into an OpenAPI path template without URL‑encoding them. Because urllib.parse.urljoin() interprets sequences such as "../" as directory traversal, an attacker who can control a path parameter in an API request can cause the provider to resolve a URL that escapes the intended API prefix and targets any backend endpoint. The request is sent with the authorization headers configured for the MCP provider, creating an authenticated SSRF that can reach internal services normally not exposed.

PrefectHQ FastMCP installations running any version prior to 3.2.0 are affected. The flaw resides in the OpenAPIProvider component, specifically the RequestDirector._build_url method.

The vulnerability has a CVSS score of 10, indicating maximum severity, but its EPSS score is below 1 %, meaning exploitation is currently considered unlikely. It is not listed in the CISA KEV catalog. The attack requires the attacker to send an API request with a crafted path parameter to a FastMCP instance; the server will then make an authenticated request to an arbitrary internal endpoint, potentially exposing sensitive data or services.