Description
fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP client can therefore authenticate as the default legacy session with a token such as ../fast-mcp-telegram/telegram when the documented default session file ~/.config/fast-mcp-telegram/telegram.session exists. This bypasses the reserved session name control that is intended to prevent HTTP multi-user sessions from colliding with the default stdio or legacy account. With account-prefixed MCP tools enabled, the attacker still sees and calls the prefixed tools for the default account, so the prefix middleware does not stop the session selection bypass. This vulnerability is fixed in 0.19.1.
Published: 2026-07-02
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Fast‑mcp‑telegram creates a session file path by concatenating the raw Bearer token string, and it rejects the token string 'telegram' but does not reject path separators or normalize the path before checking whether the session file exists. This permits an attacker to authenticate as the default legacy session with a token such as ../fast‑mcp‑telegram/telegram when the documented default session file ~/.config/fast‑mcp‑telegram/telegram.session exists, bypassing reserved session name controls and enabling unauthorized access to default MCP session tools. The weakness corresponds to CWE‑22 and CWE‑287.

Affected Systems

The affected product is fast‑mcp‑telegram released by leshchenko1979. Versions earlier than 0.19.1 validate Bearer tokens insecurely and are vulnerable. Users running any version prior to update to 0.19.1 or later must consider this vulnerability.

Risk and Exploitability

The vulnerability has a CVSS score of 9.4, indicating high‑severity remote exploitability. The EPSS score of < 1 % suggests a low but non‑zero probability of exploitation, and the absence of a KEV listing does not lessen the risk. Attackers need only a remote HTTP client capable of sending a crafted bearer token containing path traversal characters; no local privileges are required. Successful exploitation allows impersonation of the default session and unprivileged use of legacy MCP tools, potentially enabling data exfiltration or unsupported command execution.

Generated by OpenCVE AI on July 21, 2026 at 10:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade fast‑mcp‑telegram to version 0.19.1 or later, which normalizes paths and rejects path separators in bearer tokens.
  • If upgrading is not immediately possible, temporarily disable HTTP Bearer authentication endpoints or restrict external access to the service.
  • Ensure that any remaining token validation logic rejects strings containing '/' or '..' characters before authenticating.

Generated by OpenCVE AI on July 21, 2026 at 10:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rxw2-pc8j-vxwm fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
History

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Leshchenko1979
Leshchenko1979 fast-mcp-telegram
Vendors & Products Leshchenko1979
Leshchenko1979 fast-mcp-telegram

Mon, 06 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 02 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP client can therefore authenticate as the default legacy session with a token such as ../fast-mcp-telegram/telegram when the documented default session file ~/.config/fast-mcp-telegram/telegram.session exists. This bypasses the reserved session name control that is intended to prevent HTTP multi-user sessions from colliding with the default stdio or legacy account. With account-prefixed MCP tools enabled, the attacker still sees and calls the prefixed tools for the default account, so the prefix middleware does not stop the session selection bypass. This vulnerability is fixed in 0.19.1.
Title fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
Weaknesses CWE-22
CWE-287
References
Metrics cvssV3_1

{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}

Subscriptions

Leshchenko1979 Fast-mcp-telegram
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-06T14:36:02.848Z

Reserved: 2026-06-08T18:11:06.662Z

Link: CVE-2026-52830

cve-icon Vulnrichment

Updated: 2026-07-06T14:34:06.905Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T11:00:05Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-287

    Improper Authentication