CVE-2026-55096

HighCVSS 7.1

Published: 28/09/2026(UTC)Updated: 01/10/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

9th percentile - higher than 9% of all known CVEs

Summary

In fast-mcp-telegram before version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. The URL security validation checks only the literal hostname string but never resolves DNS, allowing bypass of the denylist and fetching from loopback/private/link-local addresses. Because the fetched body is returned to the attacker as a Telegram file attachment, this is a full-read, exfiltrating SSRF.

Risk Assessment

An attacker can exploit SSRF to read internal network resources and exfiltrate them, potentially leading to disclosure of sensitive data or further attacks on internal systems.

Recommendation

Update fast-mcp-telegram to version 30.1 or later. Additionally, restrict access to the MCP server and apply firewall rules blocking access to private addresses.

Other vulnerabilities in fast-mcp-telegram

CVE-2026-52830Critical
A vulnerability in fast-mcp-telegram before version 0.19.1 allows a remote HTTP client to bypass authentication by manipulating the Bearer token with path separators. A token like '../fast-mcp-telegram/telegram' grants access to the default legacy session, bypassing the reserved session name control.

Original NVD description (English source)

fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by _validate_url_security, an SSRF denylist that checks the URL's literal hostname string but never resolves DNS. The fetch (httpx.AsyncClient.get) does its own resolution at request time. Consequently a hostname that resolves to a loopback / private / link-local address passes the guard and is fetched — even with the secure defaults block_private_ips=True and allow_http_urls=False. Because the fetched body is returned to the attacker as a Telegram file attachment, this is a full-read, exfiltrating SSRF, not blind. This issue has been patched in version 30.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS