Description
fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by _validate_url_security, an SSRF denylist that checks the URL's literal hostname string but never resolves DNS. The fetch (httpx.AsyncClient.get) does its own resolution at request time. Consequently a hostname that resolves to a loopback / private / link-local address passes the guard and is fetched — even with the secure defaults block_private_ips=True and allow_http_urls=False. Because the fetched body is returned to the attacker as a Telegram file attachment, this is a full-read, exfiltrating SSRF, not blind. This issue has been patched in version 30.1.
Published: 2026-09-28
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Exfiltration via SSRF
Action: Immediate Patch
AI Analysis

Impact

fast-mcp-telegram allows file attachments via HTTP(S) URLs that the server downloads and forwards in Telegram messages. The URL validation routine checks only the literal hostname string and never performs DNS resolution, letting a hostname resolve to a loopback or private address bypass the denylist. The server then downloads the file and returns it to the attacker as an attached PDF, creating a full‑read, exfiltrating SSRF.

Affected Systems

The vulnerability exists in the Telegram MCP Server fast‑mcp‑telegram from leshchenko1979. Any release before version 0.30.1 is affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity. EPSS data is not available, so the current exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path is remote; an attacker can craft a message containing a malicious URL that resolves to a private or loopback IP, evade the server’s guard, and obtain the attacked content as a file attachment.

Generated by OpenCVE AI on September 28, 2026 at 18:46 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade fast‑mcp‑telegram to version 0.30.1 or later to apply the patch that resolves the DNS denial‑list flaw
  • Disable the ability for external users to specify HTTP(S) URLs for file attachments in the server configuration, if possible
  • Apply network segmentation or firewall rules to block outbound DNS and HTTP(S) requests to private or loopback IP ranges from the server

Generated by OpenCVE AI on September 28, 2026 at 18:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Leshchenko1979
Leshchenko1979 fast-mcp-telegram
Vendors & Products Leshchenko1979
Leshchenko1979 fast-mcp-telegram

Mon, 28 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Description fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by _validate_url_security, an SSRF denylist that checks the URL's literal hostname string but never resolves DNS. The fetch (httpx.AsyncClient.get) does its own resolution at request time. Consequently a hostname that resolves to a loopback / private / link-local address passes the guard and is fetched — even with the secure defaults block_private_ips=True and allow_http_urls=False. Because the fetched body is returned to the attacker as a Telegram file attachment, this is a full-read, exfiltrating SSRF, not blind. This issue has been patched in version 30.1.
Title SSRF via DNS-resolution gap in _validate_url_security (file download by URL)
Weaknesses CWE-184
CWE-918
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Leshchenko1979 Fast-mcp-telegram
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-01T14:39:11.027Z

Reserved: 2026-06-16T14:41:54.578Z

Link: CVE-2026-55096

cve-icon Vulnrichment

Updated: 2026-10-01T14:36:20.319Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T17:17:50.007

Modified: 2026-10-01T15:17:30.070

Link: CVE-2026-55096

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T19:15:05Z

Weaknesses
  • CWE-184

    Incomplete List of Disallowed Inputs

  • CWE-918

    Server-Side Request Forgery (SSRF)