CVE-2026-32871: FastMCP: A Malicious MCP Server's Tool Output Schema Ran Python Code in the Client (GHSA-gpgx-58w2-xwwf, Critical), Plus Seven More Advisories in Three Days

PrefectHQ published GHSA-gpgx-58w2-xwwf for fastmcp on 16 October 2026, rated critical, with no CVE. When a FastMCP client parses a successful structured tool result, it turns the server-supplied outputSchema into Python types. In the `$ref: "#"` self-reference branch the schema title went to ForwardRef without sanitizing, and Pydantic evaluated it, so an MCP server could return a schema whose title is Python code and have it run in the client process with the client's privileges. The surrounding exception handler only logs, so the tool call still looks successful. The same converter handles form elicitation schemas, and the same fix covers them. Affected: fastmcp 2.10.0 up to 3.4.8 and 4.0.0a1 up to 4.0.11; there is no fixed 2.x release. Agent hosts and gateways that connect to user-supplied MCP servers face the highest risk. Between 16 and 18 October the project published seven more advisories. Rated high: unauthenticated resource exhaustion through OAuthProxy's CIMD cache and client store, a JWKS fetch for every unknown JWT key ID in JWTVerifier that amplifies traffic to the identity provider, and an attacker-controlled regex in RegexSearchTransform that can block a worker. Rated medium: OpenAPI path parameters set to `..` reaching other backend routes (an incomplete fix for CVE-2026-32871), OpenAPI components forwarding undeclared header, cookie and query arguments that can override the configured upstream credentials, and MultiAuth merging security state across independent providers. Rated low: skill providers following a symlinked SKILL.md outside its folder.

You are affected if you run fastmcp >=2.10.0 <3.4.8 || >=4.0.0 <4.0.11. Versions 3.4.9 and later include the fix.

Upgrade fastmcp to 3.4.9 or 4.1.1 or later, which covers the client RCE (fixed in 3.4.8 and 4.0.11) and the seven later advisories, and move 2.x users to 3.4.9 or later. Until then, connect FastMCP clients only to MCP servers you trust, and treat an agent host or gateway that connected to a user-supplied or third-party MCP server as possibly compromised. Servers that use OAuthProxy, JWTVerifier, RegexSearchTransform or OpenAPI-generated tools need the same upgrade, and the OAuth endpoints should sit behind rate and size limits.

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run fastmcp and which version, then enforce a policy on it.