oM noM Security Feeds cve
vulnerability context

CVE-2026-52830

CVSS 9.4 CRITICALCWE-22

fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. A remote HTTP client can therefore authenticate as the default legacy session with a token such as ../fast-mcp-telegram/telegram when the documented default session file ~/.config/fast-mcp-telegram/telegram.session exists. This bypasses the reserved session name contr...

Published 2026-07-02

details

CISA KEV status
Not in catalog
CVSS v3
9.4 / CRITICAL
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CWE
CWE-22
OTX pulses
0 total, 0 recent

source mentions 2

source consensus

  • Bluesky
  • GitHub Advisories
Want the 3-bullet summary of CVE-2026-52830, plus webhook alerts when KEV is updated? Pro is $10/mo.