# FastMCP 4.1.2 fixes an auth gap you have to switch on. Upgrading alone won't close it.

*2026-10-21 ⬩ 2:30 PM ET | bryn*

FastMCP shipped version 4.1.2 on October 20 with a security fix that only works once you add one setting, so upgrading alone leaves the gap open. FastMCP is a Python library for building MCP servers. Those are the plug points agents use to call your tools. The [FastMCP v4.1.2 release notes on GitHub](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2) bind OAuth client credentials to a configured issuer. That's the server that hands out tokens. The catch is one line. Teams on `ClientCredentialsOAuthProvider` or `PrivateKeyJWTOAuthProvider` must set `issuer` to enable this protection; upgrading alone is insufficient.

The same release makes access rules apply after transforms, the step that reshapes a tool. It also stops a denied resource from slipping through a matching template.

Here's what I'd do. Before you bump a version, search the notes for *must set*. Then grep your config for those two provider names. A fix that waits on a setting is a config change. Your dependency bot won't open that pull request for you.

## Sources

1. [Release v4.1.2: License to Deny](https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2). GitHub (PrefectHQ/fastmcp), Oct 20, 2026.

See also: https://www.civic.com/field-notes/your-vendors-ship-mcp-servers-now

Source: https://www.civic.com/bin/fastmcp-fix-needs-a-setting