io.github.leshchenko1979/fast-mcp-telegram
Multi-tenant Telegram gateway for AI agents — HTTP+stdio, 8 tools, MTProto User API
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name io.github.leshchenko1979/fast-mcp-telegram
· Source code · Website
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| CVE-2026-55096fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guard… | high | Not checked | Sep 28, 2026 |
| GHSA-rxw2-pc8j-vxwmfast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protectionAlso filed as CVE-2026-52830, PYSEC-2026-2473 | critical | Not flagged | Jul 2, 2026 |
Versions in the registry
0.46.1 (listed), 0.46.0, 0.45.0, 0.36.0 (package 0.35.0), 0.35.0, 0.22.2, 0.5.0, 0.4.5 (package 0.4.4), 0.4.4