Fast Mcp Telegram
Monthly
Server-side request forgery in fast-mcp-telegram prior to version 30.1 allows an authenticated MCP client (CVSS PR:L) to make the server fetch arbitrary internal HTTP(S) endpoints and receive the response body back as a Telegram file attachment. The send_message and send_message_to_phone tools accept URL lists that the server downloads via httpx.AsyncClient.get, but the _validate_url_security guard only inspects the literal hostname string and never resolves DNS, so any attacker-controlled domain that resolves to a loopback, private, or link-local address passes validation - even with the secure defaults block_private_ips=True and allow_http_urls=False. Because the fetched content is exfiltrated through the Telegram attachment rather than merely observed, this is a full-read SSRF; exploitation requires an authorized MCP session and a resolving hostname (raw private-IP literals remain blocked), and no public exploit code was identified at time of analysis.
Server-side request forgery in fast-mcp-telegram prior to version 30.1 allows an authenticated MCP client (CVSS PR:L) to make the server fetch arbitrary internal HTTP(S) endpoints and receive the response body back as a Telegram file attachment. The send_message and send_message_to_phone tools accept URL lists that the server downloads via httpx.AsyncClient.get, but the _validate_url_security guard only inspects the literal hostname string and never resolves DNS, so any attacker-controlled domain that resolves to a loopback, private, or link-local address passes validation - even with the secure defaults block_private_ips=True and allow_http_urls=False. Because the fetched content is exfiltrated through the Telegram attachment rather than merely observed, this is a full-read SSRF; exploitation requires an authorized MCP session and a resolving hostname (raw private-IP literals remain blocked), and no public exploit code was identified at time of analysis.