Skip to content

fix: upgrade fastmcp to 3.2.0 to fix SSRF vulnerability (CVE) - #12516

Merged
Jkavia merged 1 commit into
release-1.9.0from
security/fixes
Apr 6, 2026
Merged

fix: upgrade fastmcp to 3.2.0 to fix SSRF vulnerability (CVE)#12516
Jkavia merged 1 commit into
release-1.9.0from
security/fixes

Conversation

@Jkavia

@Jkavia Jkavia commented Apr 6, 2026

Copy link
Copy Markdown
Collaborator

Security Fix Details

Package: fastmcp

Vulnerable Version: < 3.2.0

Fixed Version: 3.2.0

Vulnerability: Authenticated SSRF via path traversal in OpenAPIProvider

Impact: Attackers could escape API prefix and access arbitrary backend endpoints

JIRA: https://datastax.jira.com/browse/LE-771
Depbotscan:
https://github.com/langflow-ai/langflow/security/dependabot/691
https://github.com/langflow-ai/langflow/security/dependabot/690

@github-actions github-actions Bot added the bug Something isn't working label Apr 6, 2026
@coderabbitai

coderabbitai Bot commented Apr 6, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a3960cb0-61a8-4d0e-b651-55bdba346440

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch security/fixes

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov

codecov Bot commented Apr 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.09%. Comparing base (8d01ba4) to head (3740449).
⚠️ Report is 2 commits behind head on release-1.9.0.

Additional details and impacted files

Impacted file tree graph

@@                Coverage Diff                @@
##           release-1.9.0   #12516      +/-   ##
=================================================
+ Coverage          50.05%   50.09%   +0.03%     
=================================================
  Files               1930     1932       +2     
  Lines             172591   172025     -566     
  Branches           25234    24158    -1076     
=================================================
- Hits               86398    86175     -223     
+ Misses             85147    84804     -343     
  Partials            1046     1046              
Flag Coverage Δ
backend 55.86% <ø> (+0.04%) ⬆️
frontend 49.00% <ø> (+0.03%) ⬆️
lfx 49.06% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 249 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions

github-actions Bot commented Apr 6, 2026

Copy link
Copy Markdown
Contributor

Frontend Unit Test Coverage Report

Coverage Summary

Lines Statements Branches Functions
Coverage: 29%
29.69% (31319/105481) 63.69% (3976/6242) 31.04% (731/2355)

Unit Test Results

Tests Skipped Failures Errors Time
3104 0 💤 0 ❌ 0 🔥 4m 59s ⏱️

@github-actions github-actions Bot added the lgtm This PR has been approved by a maintainer label Apr 6, 2026
@Jkavia
Jkavia added this pull request to the merge queue Apr 6, 2026
Merged via the queue into release-1.9.0 with commit 66c2067 Apr 6, 2026
95 of 96 checks passed
@Jkavia
Jkavia deleted the security/fixes branch April 6, 2026 15:02
@github-actions github-actions Bot added bug Something isn't working and removed bug Something isn't working labels Apr 6, 2026
Adam-Aghili pushed a commit that referenced this pull request Apr 15, 2026
security: upgrade fastmcp to 3.2.0 to fix SSRF vulnerability (CVE)

Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working lgtm This PR has been approved by a maintainer

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants