CVE-2026-102610 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
fast-agent's serve command exposes an MCP endpoint on all network interfaces at port 8000 with no authentication. When started with --shell, any client that can reach it can make the agent run operating-system commands as the server user; without --shell, the client can still use the operator's model and configured MCP tools.
first public Jul 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run fast-agent serve, especially with --shell, on a host reachable from a network other than their own machine. The sources describe the default bind to 0.0.0.0 on port 8000 and no authentication on /mcp. Local-only use bound to localhost, or a server behind an authenticating proxy or firewall, is less exposed; the sources do not say how much that reduces risk.
Not affected if auth-proxy, fixed-version, localhost-only
Who cares mcp, python, self-hosted
pip show fast-agent-mcp (package name is unknown from the sources; confirm it).fast-agent serve processes or startup scripts that use --shell, and check whether port 8000 is reachable from other hosts./mcp endpoint.0.7.21 or later.fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.