{"uuid": "730a2791-dddd-44d6-898d-cd2c6830182c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52830", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-21T23:00:10.401355Z"}