advisories.gitlab.comadvisoryAI Security Briefing
CVE-2026-52830 describes a path traversal flaw in fast-mcp-telegram, a PyPI package exposing Telegram as an MCP server, where HTTP Bearer tokens are joined directly into a session-file path without normalization. The verifier blocks the literal reserved token "telegram" but not path separators, so a token like "../fast-mcp-telegram/telegram" lets a remote HTTP client authenticate as the default legacy session, bypassing the control meant to keep multi-user HTTP sessions from colliding with the default stdio/legacy account. Account-prefixed MCP tool naming does not prevent the bypass since prefixed tools for the compromised default account remain accessible.
TL;DR Path traversal in fast-mcp-telegram's Bearer token check lets attackers hijack the default Telegram MCP session via a token like "../fast-mcp-telegram/telegram".
CVEs named here
- CVE-2026-52830
Technologies named here
- GitLab Dependency Scanning
- fast-mcp-telegram
- PyPI
- Telegram
- Model Context Protocol
- Python
Techniques named here
- Bearer token path traversal
- Path traversal
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup