{"vulnerability": "CVE-2026-52830", "sightings": [{"uuid": "730a2791-dddd-44d6-898d-cd2c6830182c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52830", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-21T23:00:10.401355Z"}, {"uuid": "85904cf1-5ae1-4f9c-adf6-1b85884626c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52830", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpozshgwxf2b", "content": "\ud83d\udd34 CVE-2026-52830 - Critical (9.4)\n\nfast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bea...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-52830/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-02T22:00:50.488827Z"}, {"uuid": "2721e3f0-4ae7-42c5-a904-fca4a73c386a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52830", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mprjyv7j6527", "content": "CVE-2026-52830 - fast-mcp-telegram\nAn attacker can access the default Telegram account without a valid token, potentially reading and sending messages, if a specific session file exists on the server. To\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#leshchenko1979 #pip #CVE #infosec", "creation_timestamp": "2026-07-03T21:56:04.565126Z"}, {"uuid": "789edb63-cc02-460c-9939-d15770a6f0ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52830", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-22T00:00:26.771878Z"}, {"uuid": "d6f5eeb0-829a-4d51-96cd-b41bcda32507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52830", "type": "seen", "source": "https://t.me/pphm_HackerNews/1828", "content": "\ud83d\udd34 Critical fast-mcp-telegram Vulnerability Lets Attackers Access Telegram Session Without Token\n\nA critical vulnerability in fast-mcp-telegram (CVE-2026-52830, GHSA-rxw2-pc8j-vxwm) allows attackers to access a Telegram MCP session over HTTP without a valid bearer token by abusing a path-traversal flaw in how session files are resolved on disk.\n\nThis breaks the intended high-entropy token boundary and exposes the default Telegram account to full message and MTProto access.\n\nfast-mcp-telegram is a Telegram MCP server that bridges Telegram accounts to AI assistants and HTTP clients via a session-based authentication model.", "creation_timestamp": "2026-08-23T00:00:43.240806Z"}]}