fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
- Product
- fast-mcp-telegram
- CVE
- CVE-2026-52830
- Affected
- pip/fast-mcp-telegram <= 0.19.0
- Fixed in
- 0.19.1
Last verified against sources: October 26, 2026
Am I affected?
fast-mcp-telegram: affected pip/fast-mcp-telegram <= 0.19.0. Fixed in 0.19.1.
- Check your version: run
pip show fast-mcp-telegram. Versions <= 0.19.0 of fast-mcp-telegram are affected. [1]
What to do now
- Upgrade to the fixed version: run
pip install --upgrade "fast-mcp-telegram>=0.19.1"(first patched version 0.19.1). [1] - Reject bearer tokens that are not strict opaque token identifiers before using them in file paths. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. [1]
- The verifier rejects the exact reserved token
telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. [1] - A remote HTTP client can therefore authenticate as the default legacy session with a token such as
../fast-mcp-telegram/telegramwhen the documented default session file~/.config/fast-mcp-telegram/telegram.sessionexists. [1] - This bypasses the reserved session name control that is intended to prevent HTTP multi-user sessions from colliding with the default stdio or legacy account. [1]
Impact
- An unauthenticated network client can access the Telegram account represented by the default
telegram.sessionfile without knowing a generated bearer token, if that legacy or default session file is present on a server running HTTP auth. [1] - The attacker can then call Telegram MCP tools as that account, including message reading, message sending, MTProto API calls, and attachment-producing tool surfaces available to the session. [1]
What was done
- Packages: pip/fast-mcp-telegram affected <= 0.19.0 patched 0.19.1. [1]
- Resolve the final session path and require it to remain directly under the configured session directory. [1]
- Apply the same validation in
SessionFileTokenVerifier, URL auth middleware, setup flows, cleanup code, and any code that opens session files by token. [1]
Sources
- GHSA-rxw2-pc8j-vxwm — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-52830] fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection
Product: fast-mcp-telegram | Affected: pip/fast-mcp-telegram <= 0.19.0 | Fixed in: 0.19.1
Summary: fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/07/cve-2026-52830-fast-mcp-telegramCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-52830
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.