7.4
High
CVE-2025-69196 FastMCP is the standard framework for building MCP applications
Description
FastMCP is the standard framework for building MCP applications. Prior to version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. Instead of issuing the token explicitly for the MCP server, the token is issued for the base_url passed to the OAuthProxy during initialization. This issue has been patched 2.14.2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Developer Hub | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| fastmcp 2.14 | earliest → < 2.14.2 | 2.14.2 |
| Red Hat Satellite 6.18 1782739344 | earliest → < 1782739344 | 1782739344 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Satellite 6
The 195 CVEs of Red Hat Satellite 6 →
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
High
CVE-2026-93998
Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
7.4
High
CVE-2026-120971
A flaw was found in RESTEasy's default exception mapper
5.3
Medium
CVE-2026-114406
Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns
6.8
Medium