https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 27 Aug 2026 17:11:06 +0000 https://vulnerability.circl.lu/sighting/5b04c7d1-7cae-4c40-b720-adaca5947917/export {"uuid": "5b04c7d1-7cae-4c40-b720-adaca5947917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXW2-PC8J-VXWM", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-23T00:00:43.300413Z"} {"uuid": "5b04c7d1-7cae-4c40-b720-adaca5947917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXW2-PC8J-VXWM", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-23T00:00:43.300413Z"} https://vulnerability.circl.lu/sighting/5b04c7d1-7cae-4c40-b720-adaca5947917/export Sun, 23 Aug 2026 00:00:43 +0000 https://vulnerability.circl.lu/sighting/9794c96e-f424-4e48-89ba-44600ed38139/export {"uuid": "9794c96e-f424-4e48-89ba-44600ed38139", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXW2-PC8J-VXWM", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-22T00:00:26.806395Z"} {"uuid": "9794c96e-f424-4e48-89ba-44600ed38139", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXW2-PC8J-VXWM", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-22T00:00:26.806395Z"} https://vulnerability.circl.lu/sighting/9794c96e-f424-4e48-89ba-44600ed38139/export Sat, 22 Aug 2026 00:00:26 +0000 https://vulnerability.circl.lu/sighting/009031b3-24dc-47e2-8f93-d1ddf879aec6/export {"uuid": "009031b3-24dc-47e2-8f93-d1ddf879aec6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXW2-PC8J-VXWM", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-21T23:00:10.434825Z"} {"uuid": "009031b3-24dc-47e2-8f93-d1ddf879aec6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-RXW2-PC8J-VXWM", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-21T23:00:10.434825Z"} https://vulnerability.circl.lu/sighting/009031b3-24dc-47e2-8f93-d1ddf879aec6/export Fri, 21 Aug 2026 23:00:10 +0000