FastMCP, a Python framework for building MCP servers and clients, had a vulnerability in its OpenAPIProvider prior to version 3.2.0. The RequestDirector class's _build_url() method substitutes path parameters directly into URL templates without URL-encoding. Because urllib.parse.urljoin() interprets '../' sequences as directory traversal, an attacker controlling path parameters can escape the API prefix and access arbitrary backend endpoints. This results in authenticated SSRF, leveraging the authorization headers configured in the MCP provider. The vulnerability is identified as CWE-918 and has a CVSS 4.0 score of 10.0, indicating critical severity. The issue is fixed in fastmcp version 3.2.0.

An attacker with the ability to authenticate to the MCP client can exploit this vulnerability to perform SSRF attacks, sending requests to arbitrary backend endpoints with the authorization headers of the MCP provider. This can lead to unauthorized access to internal services and sensitive data exposure. The vulnerability has a critical CVSS score of 10.0, reflecting the high impact on confidentiality, integrity, and availability.

This vulnerability has been patched in fastmcp version 3.2.0. Users should upgrade to version 3.2.0 or later to remediate this issue. No other mitigation is required as the fix addresses the root cause by properly handling URL construction and encoding.