CVE-2026-52830: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in leshchenko1979 fast-mcp-telegram
fast-mcp-telegram versions prior to 0.19.1 contain a path traversal vulnerability in the HTTP Bearer token validation process. The software improperly constructs a session-file path by joining the raw token string without normalizing or rejecting path separators. This allows a remote attacker to bypass reserved token restrictions and authenticate as the default legacy session by using crafted tokens containing path traversal sequences. The vulnerability is fixed in version 0.19.1.
AI Analysis
Technical Summary
The vulnerability in fast-mcp-telegram (CVE-2026-52830) arises from improper limitation of a pathname to a restricted directory (CWE-22). Before version 0.19.1, the software validates HTTP Bearer tokens by directly joining the raw token string into a session-file path without normalizing or rejecting path separators. Although the verifier rejects the exact reserved token 'telegram', it does not prevent tokens containing path traversal sequences such as '../fast-mcp-telegram/telegram'. This enables a remote HTTP client to authenticate as the default legacy session if the corresponding session file exists. The bypass affects multi-user session controls and allows access to prefixed MCP tools for the default account. The issue is resolved in version 0.19.1.
Potential Impact
An unauthenticated remote attacker can exploit this path traversal vulnerability to bypass authentication controls and impersonate the default legacy session. This leads to unauthorized access with high confidentiality and integrity impact, as the attacker can interact with the default account's MCP tools. Availability impact is low. The CVSS v3.1 base score is 9.4 (critical).
Mitigation Recommendations
Upgrade fast-mcp-telegram to version 0.19.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.
CVE-2026-52830: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in leshchenko1979 fast-mcp-telegram
Description
fast-mcp-telegram versions prior to 0.19.1 contain a path traversal vulnerability in the HTTP Bearer token validation process. The software improperly constructs a session-file path by joining the raw token string without normalizing or rejecting path separators. This allows a remote attacker to bypass reserved token restrictions and authenticate as the default legacy session by using crafted tokens containing path traversal sequences. The vulnerability is fixed in version 0.19.1.
CVSS v3.1
Score 9.4critical
Affected software
pkg:github/leshchenko1979/fast-mcp-telegramRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in fast-mcp-telegram (CVE-2026-52830) arises from improper limitation of a pathname to a restricted directory (CWE-22). Before version 0.19.1, the software validates HTTP Bearer tokens by directly joining the raw token string into a session-file path without normalizing or rejecting path separators. Although the verifier rejects the exact reserved token 'telegram', it does not prevent tokens containing path traversal sequences such as '../fast-mcp-telegram/telegram'. This enables a remote HTTP client to authenticate as the default legacy session if the corresponding session file exists. The bypass affects multi-user session controls and allows access to prefixed MCP tools for the default account. The issue is resolved in version 0.19.1.
Potential Impact
An unauthenticated remote attacker can exploit this path traversal vulnerability to bypass authentication controls and impersonate the default legacy session. This leads to unauthorized access with high confidentiality and integrity impact, as the attacker can interact with the default account's MCP tools. Availability impact is low. The CVSS v3.1 base score is 9.4 (critical).
Mitigation Recommendations
Upgrade fast-mcp-telegram to version 0.19.1 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-08T18:11:06.662Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a46d2df27e9c797191734e5
Added to database: 07/02/2026, 21:06:39 UTC
Last enriched: 07/02/2026, 21:21:17 UTC
Last updated: 07/02/2026, 21:47:53 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.