Critical Path-Traversal Vulnerability Patched in Telegram MCP Package

fast-mcp-telegram, an open-source Model Context Protocol (MCP) server that connects Telegram accounts to AI assistants, has received an emergency patch to resolve a critical security vulnerability. Tracked as CVE-2026-52830, the flaw is a path-traversal vulnerability that allows unauthenticated remote attackers to bypass HTTP Bearer token authentication. By exploiting the flaw, attackers can hijack the default Telegram session on the server to read messages, send unauthorized communications, make arbitrary MTProto API calls, and access attachment-producing tool surfaces.

The security defect impacts all versions of fast-mcp-telegram up to and including version 0.19.0. The vulnerability has been fully patched with the release of version 0.19.1, which introduces stricter validation of bearer tokens.

---

How improper validation breaks the bearer token boundary

The fast-mcp-telegram package bridges Telegram’s messaging infrastructure with large language models and HTTP clients using a session-based authentication model. When clients connect, they present an HTTP Bearer token to authorize their requests. Under normal operation, this token acts as a high-entropy secret key that uniquely maps to a corresponding session file on disk.

The vulnerability arises because the package’s token-verifier component, located in SessionFileTokenVerifier.verify_token(), handles incoming bearer tokens as raw filesystem inputs rather than opaque security identifiers.

To authorize a connection, the software checks for the existence of a corresponding session file. It does this by directly joining the raw token string with a pre-configured session directory, appending a .session extension, and testing if the resulting file path exists on disk.

Crucially, the software does not normalize or sanitize the path before checking it. This allows standard directory traversal sequences—such as forward slashes (/), backslashes (\), and dot-dot (..) patterns—to be evaluated directly by the underlying operating system’s filesystem.

---

Bypassing the default session restriction

By default, the server configuration explicitly blocks users from submitting the literal token string telegram. This restriction is in place because telegram is the documented default name for the server’s primary or legacy session. Under normal deployment conditions, this default session file is generated and stored locally on the host machine at the following path:

~/.config/fast-mcp-telegram/telegram.session

While the verifier’s blocklist successfully rejects the exact string telegram, the lack of path normalization allows attackers to bypass this rule using a relative path alias. An unauthenticated network client can send a crafted HTTP Authorization header containing a relative path:

Authorization: Bearer ../fast-mcp-telegram/telegram

When the application evaluates this input, it joins the string with its active session directory. The filesystem resolves the traversal sequence, collapsing the path back to the target default session file.

Because the final path points to a file that exists on the disk, the verification check passes. The server then mistakenly authenticates the remote attacker as the default Telegram user.

---

Impact of session hijack on AI tool execution

Once authenticated via the path-traversal exploit, the attacker inherits full control of the default Telegram account associated with that session file. This access allows the attacker to execute any exposed capabilities configured on the MCP server.

Specifically, the attacker can:

• Read private chat histories and search through messages
• Draft and send automated messages to chats and contacts
• Access message attachments and file media
• Issue direct calls to Telegram’s low-level MTProto API
• Access attachment-producing tool surfaces available to the compromised account

Security disclosures confirm that down-stream middleware, such as FastMCP’s account-prefix system, does not mitigate the exploit. The prefix middleware labels available tools based on whichever account the session token resolves to.

Because the traversal token is validated as a legitimate token during the initial authentication phase, the prefix middleware behaves as designed, automatically surfacing and exposing the default account’s prefixed tools to the unauthenticated attacker.

---

Remediation and patch details

The vulnerability was reported to the project’s maintainers by GitHub user DavidCarliez. It has been addressed in fast-mcp-telegram version 0.19.1.

The updated version prevents directory traversal by validating that the resolved session file path remains strictly inside the designated session directory. The updated software also treats tokens as opaque string identifiers, rejecting any token that contains path separators or traversal characters.

Administrators running self-hosted instances of fast-mcp-telegram with HTTP authentication enabled are advised to upgrade immediately to version 0.19.1 or higher to secure their active Telegram sessions.