FastMCP's OpenAPIProvider contains a critical vulnerability (CVE-2026-32871) in its URL construction logic where path parameters are substituted without URL encoding. This allows an authenticated attacker to perform Server-Side Request Forgery (SSRF) combined with path traversal by injecting traversal sequences into path parameters. As a result, attackers can access internal backend endpoints outside the intended API scope, inheriting the MCP provider's authorization context. This vulnerability enables unauthorized access to sensitive internal APIs, privilege escalation, and potential data exfiltration or service disruption.