A critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.
This breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.
fast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.
In affected versions (≤ 0.19.0), bearer tokens are validated by directly joining the raw token string with a session directory to build a *.session path, and then checking whether that file exists.
The verifier strips whitespace and rejects reserved names such as telegram, which is documented as the default session_name. However, it does not normalize the path or reject path separators and traversal sequences. As a result, the bearer token is effectively treated as a filesystem-relative path, rather than an opaque identifier.
The vulnerable logic in SessionFileTokenVerifier.verify_token() first denies tokens whose lowercase values appear in a reserved-name list, including ‘telegram’. It then builds the session path as session_dir/f”{token}.session” and accepts the token if that path points to an existing file.
The same pattern is used when constructing the client-side path in src/client/connection.py, where SESSION_DIR / f”{token}.session” is passed to the Telegram client builder.
Crucially, no step enforces that the resolved session path stays within the configured session directory, and no check rejects /, \\, ., .., absolute paths, or other traversal constructs in the token string.
In a typical deployment, the default or legacy Telegram session for the MCP server is stored at ~/.config/fast-mcp-telegram/telegram.session, and the documentation explicitly reserves the name telegram to avoid collisions with stdio and HTTP no-auth sessions.
While the reserved-name guard correctly rejects the exact token telegram, an attacker can supply a traversal alias, such as ../fast-mcp-telegram/telegram, in the HTTP Authorization: Bearer header.
When combined with the session directory, this token resolves to ~/.config/fast-mcp-telegram/../fast-mcp-telegram/telegram.session, which collapses to the same default telegram.session file once the filesystem processes … Because the code only checks is_file() on the unnormalized path, the traversal alias is accepted, and the server authenticates the attacker as the default Telegram account.
This behavior crosses the intended authentication boundary. Production HTTP auth deployments expect each client to present an unguessable, high-entropy bearer token mapped to a unique session file, and reserved names are blocked to prevent common tokens like telegram from colliding with shared or legacy sessions
The path-traversal alias effectively turns the bearer-token namespace back into a filesystem namespace, allowing an unauthenticated client to select the privileged default session by simply choosing a crafted relative path rather than guessing a secret.
Once authenticated as that account, the attacker can read and send Telegram messages, issue MTProto API calls, and invoke any exposed tools and attachment surfaces configured for that session.
Middleware that prefixes tools by account operates downstream of authentication and therefore cannot repair the broken boundary. Once the traversal token is accepted as a valid access token, the default account’s prefixed tools are listed and can be called.
At the same time, unprefixed calls are still correctly denied. This confirms that the bug lies in session selection and authentication, not in tool prefix enforcement.
The vulnerability affects fast-mcp-telegram versions up to 0.19.0; version 0.19.1 introduces stricter validation to treat bearer tokens as opaque identifiers, as reported by DavidCarliez in Gitbub.
Recommended remediation includes enforcing a safe token alphabet (for example, a URL-safe base64-like pattern of sufficient length), rejecting path separators and traversal constructs, resolving and verifying that the final session path remains directly under the configured session directory, and applying consistent checks across header-based auth, URL auth, setup flows, cleanup routines, and any code that opens session files by token.
Deployments should immediately upgrade, rotate any default or legacy session files, and audit logs for suspicious bearer values containing traversal sequences.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…