{"metadata": {"vulnerability": "CVE-2026-52830", "count": 17, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-06-08T18:11:06.662Z", "date_only": false, "value": "2026-06-08T18:11:06.662Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-52830", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-02T20:38:50Z", "date_only": false, "value": "2026-07-02T20:38:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RXW2-PC8J-VXWM", "record": "GHSA-RXW2-PC8J-VXWM", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-02T20:39:35.927Z", "date_only": false, "value": "2026-07-02T20:39:35.927Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-52830", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-02T20:39:35.927Z", "date_only": false, "value": "2026-07-02T20:39:35.927Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-52830", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-02T21:16:56Z", "date_only": false, "value": "2026-07-02T21:16:56Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-RXW2-PC8J-VXWM", "record": "GHSA-RXW2-PC8J-VXWM", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-07-02T21:16:56.847Z", "date_only": false, "value": "2026-07-02T21:16:56.847", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-52830", "record": "FKIE_CVE-2026-52830", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-02T22:00:50.488Z", "date_only": false, "value": "2026-07-02T22:00:50.488827Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpozshgwxf2b", "record": "CVE-2026-52830", "field": "creation_timestamp", "uuid": "85904cf1-5ae1-4f9c-adf6-1b85884626c2", "content": "\ud83d\udd34 CVE-2026-52830 - Critical (9.4)\n\nfast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bea...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-52830/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpozshgwxf2b"}, {"timestamp": "2026-07-03T21:56:04.565Z", "date_only": false, "value": "2026-07-03T21:56:04.565126Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mprjyv7j6527", "record": "CVE-2026-52830", "field": "creation_timestamp", "uuid": "2721e3f0-4ae7-42c5-a904-fca4a73c386a", "content": "CVE-2026-52830 - fast-mcp-telegram\nAn attacker can access the default Telegram account without a valid token, potentially reading and sending messages, if a specific session file exists on the server. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#leshchenko1979 #pip #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mprjyv7j6527"}, {"timestamp": "2026-07-06T14:35:51.099Z", "date_only": false, "value": "2026-07-06T14:35:51.099192Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-52830", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-06T14:35:51.099Z", "date_only": false, "value": "2026-07-06T14:35:51.099192Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-52830", "record": "FKIE_CVE-2026-52830", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-07-06T14:36:02.848Z", "date_only": false, "value": "2026-07-06T14:36:02.848Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-52830", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-07-06T14:36:02.848Z", "date_only": false, "value": "2026-07-06T14:36:02.848Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-52830", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-13T15:46:27.565Z", "date_only": false, "value": "2026-07-13T15:46:27.565228Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-2473", "record": "PYSEC-2026-2473", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-07-13T16:04:01.595Z", "date_only": false, "value": "2026-07-13T16:04:01.595842Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-2473", "record": "PYSEC-2026-2473", "field": "modified", "linked_record": true}, {"timestamp": "2026-08-13T16:57:36Z", "date_only": false, "value": "2026-08-13T16:57:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-RXW2-PC8J-VXWM", "record": "GHSA-RXW2-PC8J-VXWM", "field": "modified", "linked_record": true}, {"timestamp": "2026-08-21T23:00:10.401Z", "date_only": false, "value": "2026-08-21T23:00:10.401355Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/1828", "record": "CVE-2026-52830", "field": "creation_timestamp", "uuid": "730a2791-dddd-44d6-898d-cd2c6830182c", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "url": "https://t.me/pphm_HackerNews/1828"}, {"timestamp": "2026-10-25T21:10:00.770Z", "date_only": false, "value": "2026-10-25T21:10:00.770", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-52830", "record": "FKIE_CVE-2026-52830", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-11T20:35:19.207Z", "anchors": {"origin": {"timestamp": "2026-07-02T20:38:50Z", "date_only": false, "value": "2026-07-02T20:38:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RXW2-PC8J-VXWM", "record": "GHSA-RXW2-PC8J-VXWM", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-02T20:38:50Z", "date_only": false, "value": "2026-07-02T20:38:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RXW2-PC8J-VXWM", "record": "GHSA-RXW2-PC8J-VXWM", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 11404589.207758, "hours": 3167.9414465994446, "days": 131.99756027497685, "min_seconds": 11404589.207758, "max_seconds": 11404589.207758, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-02T20:38:50Z", "date_only": false, "value": "2026-07-02T20:38:50Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-RXW2-PC8J-VXWM", "record": "GHSA-RXW2-PC8J-VXWM", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-11T20:35:19.207Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}