CVE-2026-52830: Path Traversal in fast-mcp-telegram Bearer Token Validation Exposes Telegram Session Files — Threadlinqs Intelligence
As of 2026-07-10, CVE-2026-52830: Path Traversal in fast-mcp-telegram Bearer Token Validation Exposes Telegram Session Files is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-1190 · Severity: CRITICAL · CVSS: 9.4 · Status: PATCHED · Category: VULNERABILITY
fast-mcp-telegram, a Python/PyPI Model Context Protocol (MCP) server that bridges Telegram accounts to AI assistants and HTTP clients, fails to sanitize HTTP Bearer tokens before joining them into a
fast-mcp-telegram exposes an HTTP-accessible MCP (Model Context Protocol) server that lets AI assistants and HTTP clients drive a Telegram account through MTProto. To support multiple concurrent Telegram sessions over HTTP, the server authenticates each request with a Bearer token and resolves that token to a session file on disk via `SessionFileTokenVerifier.verify_token()`, which constructs the path as `session_dir / f"{token}.session"`.
To stop HTTP clients from silently reusing the operator's own default account, the verifier explicitly denies tokens whose lowercase value matches a small reserved-name list, including the literal string `telegram` (the default session's base filename). However, the verifier never normalizes the token or rejects path separators, `..` segments, or absolute paths before performing this check and before joining the token into the filesystem path. Because the blocklist compares only the raw token string, an attacker can trivially route around it: a token such as `../fast-mcp-telegram/telegram` does not equal the literal string `telegram`, so the blocklist check passes, yet when joined and resolved on disk it points at the exact same file, `~/.config/fast-mcp-telegram/telegram.session` (the config/session directory is itself named `fast-mcp-telegram`, so a single `../` traversal segment plus the real filename recreates the original path).
Once the traversal-crafted Bearer token resolves to an existing session file, the verifier treats the request as successfully authenticated as that session's owner, entirely without any prior authentication, valid credential, or user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N). The attacker is now driving the default (typically privileged, first-configured) Telegram account through every MCP tool exposed by the server: reading and sending messages and attachments, enumerating chats/contacts, and issuing arbitrary MTProto API calls available to that session. This holds even in deployments that intentionally enable per-user, account-prefixed MCP tools specifically to prevent HTTP multi-tenant clients from ever touching the default account — the path-traversal bypass defeats that isolation control entirely, collapsing the server's authentication model down to unauthenticated full-account access. Confidentiality and integrity impact are both High; availability impact is Low (the flaw does not directly enable session/file destruction), yielding the published CVSS 3.1 base score of 9.4 (Critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.
The flaw is dual-classified CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal) and CWE-287 (Improper Authentication), reflecting that the root defect is a path-normalization failure but the security consequence is a full authentication bypass. It was reported by researcher DavidCarliez, assigned GHSA-rxw2-pc8j-vxwm by the GitHub Advisory Database and CVE-2026-52830, and published July 2, 2026 (NVD last modified July 6, 2026), with broad security-press coverage (Cyber Security News, GBHackers, TheHackerWire, Cryptika, Rankiteo) starting July 7, 2026. It was fixed in fast-mcp-telegram 0.19.1 by enforcing a safe token alphabet, rejecting traversal/absolute-path characters, and verifying the resolved path stays within the configured session directory.
The vulnerability sits within a broader 2026 pattern of MCP ecosystem insecurity: independent research (VIPER-MCP scanning ~39,884 public MCP repositories; Censys internet scanning) found 106 zero-day-class MCP vulnerabilities, roughly 12,520 publicly exposed MCP services (~40% with no authentication at all), 43% of servers carrying command-injection-class flaws, and 79% handling credentials in plaintext, with over 30 CVEs filed against MCP servers between January and February 2026 alone. This CVE maps directly to two OWASP MCP Top 10 categories: MCP07 (Insufficient Authentication and Authorization) and, via its file-path handling root cause, the path
Weaknesses (CWE)
CWE-22, CWE-287
Target sectors: technology, ai-services
Target regions: Global
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-52830, T1595, T1596, T1190, T1133, T1078, T1059, T1098, T1078, T1211, T1036
