7.4
Élevée
CVE-2025-69196 FastMCP is the standard framework for building MCP applications
Description
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Satellite 6 | Versions non publiées | |
| Red Hat Developer Hub | Versions non publiées | |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées | |
| fastmcp 2.14 | premières → < 2.14.2 | 2.14.2 |
| Red Hat Satellite 6.18 1782739344 | premières → < 1782739344 | 1782739344 |
Autres CVE de Red Hat Satellite 6
Les 196 CVE de Red Hat Satellite 6 →
CVE-2026-123037
Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
6.7
Moyenne
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
Élevée
CVE-2026-93998
Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
7.4
Élevée
CVE-2026-120971
A flaw was found in RESTEasy's default exception mapper
5.3
Moyenne