AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by FastMCP M2M OAuth providers did not bind credentials to an issuer? What should I do?

    FastMCP's OAuth client wrappers did not bind credentials to an issuer.

    Affected: fastmcp 4.0.0 to 4.1.1 and fastmcp-slim 4.0.0 to 4.1.1. Fixed in: 4.1.2. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/ghsa-vqqp-x5qm-5qp4-fastmcp (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: fastmcp 4.0.0 to 4.1.1 and fastmcp-slim 4.0.0 to 4.1.1. Fixed in: 4.1.2.

      • Check your version: run pip show fastmcp. Versions >= 4.0.0a1, < 4.1.2 of fastmcp are affected.
      • Check your version: run pip show fastmcp-slim. Versions >= 4.0.0a1, < 4.1.2 of fastmcp-slim are affected.

      What to do now

      1. Upgrade to the fixed version: run pip install --upgrade "fastmcp>=4.1.2" (first patched version 4.1.2).
      2. Upgrade to the fixed version: run pip install --upgrade "fastmcp-slim>=4.1.2" (first patched version 4.1.2).
      3. Upgrade to FastMCP 4.1.2.
      4. Configure issuer with the issuer identifier of the authorization server that issued the credentials; upgrading alone is not enough.
      5. Rotate client secrets or other reusable credentials that may already have been sent to an untrusted endpoint.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/10/ghsa-vqqp-x5qm-5qp4-fastmcp (opens external site)

      Did this work for you?

    Add your answer or comment