The one that matters
FastMCP is a widely deployed Python framework for building MCP servers, with about 13.6 million weekly downloads. Its maintainers at PrefectHQ published fourteen security advisories for it in three days. The cluster is unusually large. One was critical, five were high, and the rest were moderate or low.
One advisory is critical. GHSA-gpgx-58w2-xwwf is a client-side remote code execution. A malicious MCP server can describe a tool with an output schema whose title points back at itself, and the FastMCP client compiles and evaluates that reference when it parses a successful result. The tool call still looks successful, because the exception handler only logs. Versions back to 2.10.0 are affected, and there is no fixed 2.x release.
What it signals
The other advisories cover a range: a bypass of per-tool authorization, a command injection in the Claude Code and Gemini CLI installers, and two resource-exhaustion flaws in OAuth and JWT handling. One lands hardest. The advisory names agent hosts and gateways that connect to user-supplied MCP servers as the high-risk case.
This is a vendor-advisory cluster, not a live incident, so there is no victim and no observed exploitation. The count is the point. It marks the client side of MCP as its own attack surface.
Log take: Connecting an agent to a server you do not control is the risk, and the batch-wide fix is patching to 3.4.9 or 4.1.1. (Interpretation; vendor-published advisories.)