Critical fast-mcp

Gbhackers •Divya • July 6, 2026

A critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk. This breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access. Critical […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in fast-mcp-telegram Exposes Telegram Sessions A critical vulnerability (CVE-2026-52830) in the fast-mcp-telegram package allows attackers to access Telegram MCP sessions without a valid bearer token due to a path-traversal flaw. This flaw affects all versions up to 0.19.0, exposing sensitive session data and enabling unauthorized actions. The vulnerability was published on July 2, 2026, and has been addressed in version 0.19.1. Users of the affected package are urged to update immediately to mitigate risks. The flaw compromises the integrity of Telegram accounts, potentially leading to unauthorized access to messages and MTProto operations. The vulnerability's critical nature necessitates immediate action from developers and users alike. 2 sources 73

Extracted Entities

Critical fast-mcp

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)