https://vulnerability.circl.lu/sightings/feed 2026-08-27T17:11:05.879419+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/5b04c7d1-7cae-4c40-b720-adaca5947917/export 2026-08-27T17:11:05.889792+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5b04c7d1-7cae-4c40-b720-adaca5947917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXW2-PC8J-VXWM", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-23T00:00:43.300413Z"} 2026-08-23T00:00:43.300413+00:00 https://vulnerability.circl.lu/sighting/9794c96e-f424-4e48-89ba-44600ed38139/export 2026-08-27T17:11:05.891200+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9794c96e-f424-4e48-89ba-44600ed38139", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXW2-PC8J-VXWM", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-22T00:00:26.806395Z"} 2026-08-22T00:00:26.806395+00:00 https://vulnerability.circl.lu/sighting/009031b3-24dc-47e2-8f93-d1ddf879aec6/export 2026-08-27T17:11:05.891318+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "009031b3-24dc-47e2-8f93-d1ddf879aec6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXW2-PC8J-VXWM", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-21T23:00:10.434825Z"} 2026-08-21T23:00:10.434825+00:00