{"id":"CVE-2026-102610","kind":"vulnerability","aliases":["CVE-2026-102610"],"related":[],"title":"fast-agent: unauthenticated MCP server can run OS commands remotely","description":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.","summary":"fast-agent's serve command exposes an MCP endpoint on all network interfaces at port 8000 with no authentication. When started with --shell, any client that can reach it can make the agent run operating-system commands as the server user; without --shell, the client can still use the operator's model and configured MCP tools.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mcp","python","self-hosted"],"not_affected_if":["auth-proxy","fixed-version","localhost-only"],"how_to_check":"- Check the installed fast-agent version, for example with `pip show fast-agent-mcp` (package name is unknown from the sources; confirm it).\n- Look for `fast-agent serve` processes or startup scripts that use `--shell`, and check whether port `8000` is reachable from other hosts.\n- Confirm whether the server sits behind authentication or a firewall that blocks the `/mcp` endpoint.","fix":"- fast-agent: move to `0.7.21` or later.","status":"open","published_at":"2026-11-06T21:17:05+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","triaged_at":"2026-11-06T21:46:44+00:00","updated_at":"2026-11-06T21:46:44+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-06T21:46:44Z","model":"claude-haiku-5-5","output":{"fix":"- fast-agent: move to `0.7.21` or later.","reach":"network","title":"fast-agent: unauthenticated MCP server can run OS commands remotely","impact":"high","summary":"fast-agent's serve command exposes an MCP endpoint on all network interfaces at port 8000 with no authentication. When started with --shell, any client that can reach it can make the agent run operating-system commands as the server user; without --shell, the client can still use the operator's model and configured MCP tools.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ai-tooling","mcp","python","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"remote client runs OS commands as the server user","analyst_note":"Confirm the package name and whether the no-shell case is exploitable beyond model and tool misuse; check the vendor advisory linked in the sources.","how_to_check":"- Check the installed fast-agent version, for example with `pip show fast-agent-mcp` (package name is unknown from the sources; confirm it).\n- Look for `fast-agent serve` processes or startup scripts that use `--shell`, and check whether port `8000` is reachable from other hosts.\n- Confirm whether the server sits behind authentication or a firewall that blocks the `/mcp` endpoint.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","localhost-only","auth-proxy"],"who_is_affected":"Teams that run fast-agent serve, especially with --shell, on a host reachable from a network other than their own machine. The sources describe the default bind to 0.0.0.0 on port 8000 and no authentication on /mcp. Local-only use bound to localhost, or a server behind an authenticating proxy or firewall, is less exposed; the sources do not say how much that reduces risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000783,"input_tokens":4438,"output_tokens":679,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102610':14A,17A '-2026':13A,16A '/mcp':128C '0.0.0.0':114C '0.7.21':104C,214C '8000':42B,117C 'access':207C 'agent':3A,28B,59B,86C,96C,107C,134C,144C 'ai':19B,95C 'ai-tool':18B 'allow':120C 'authent':45B,119C 'bound':112C 'build':91C 'call':146C 'caus':160C 'cli/commands/serve.py':191C 'client':51B,72B,123C,158C,174C 'command':10A,31B,64B,164C 'configur':81B,183C 'consum':177C 'context':99C 'cve':12A,15A 'default':187C 'defin':189C 'describ':206C 'endpoint':35B,129C 'evalu':94C 'execut':149C 'expos':32B,133C 'fast':2A,27B,85C,106C 'fast-ag':1A,26B,84C,105C 'fix':211C 'framework':89C 'host':25B 'http':110C 'implement':151C 'interact':198C 'interfac':39B 'invok':131C 'issu':209C 'local':148C 'make':57B 'mcp':5A,21B,34B,82B,184C 'mcp/server/agent_server.py':193C 'model':79B,98C,181C 'network':38B,122C 'non':197C 'non-interact':196C 'oper':62B,77B,162C,179C 'operating-system':61B,161C 'os':9A 'permiss':200C 'port':41B,116C 'prevent':204C 'prior':102C 'prompt':201C 'protocol':100C 'python':22B 'reach':54B,126C 'remot':11A,157C 'run':8A,60B,92C,166C 'self':24B 'self-host':23B 'serv':30B,108C 'server':6A,67B,138C,169C,199C 'shell':49B,70B,142C,172C 'start':47B,140C 'still':74B,176C 'support':101C 'system':63B,163C 'tool':20B,83B,135C,150C,185C 'tools/local_shell_executor.py':153C 'transport':111C 'unauthent':4A,156C 'use':75B,109C 'user':68B,170C 'version':213C 'without':69B,118C,171C","nicknames":[],"mitigations":[],"who_affected":"Teams that run fast-agent serve, especially with --shell, on a host reachable from a network other than their own machine. The sources describe the default bind to 0.0.0.0 on port 8000 and no authentication on /mcp. Local-only use bound to localhost, or a server behind an authenticating proxy or firewall, is less exposed; the sources do not say how much that reduces risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","mcp","medium","python","selfhosted"],"campaign_type":null,"search_a":"'-102610':14A,17A '-2026':13A,16A 'agent':3A 'command':10A 'cve':12A,15A 'fast':2A 'fast-ag':1A 'mcp':5A 'os':9A 'remot':11A 'run':8A 'server':6A 'unauthent':4A","search_b":"'8000':42B 'agent':28B,59B 'ai':19B 'ai-tool':18B 'authent':45B 'client':51B,72B 'command':31B,64B 'configur':81B 'endpoint':35B 'expos':32B 'fast':27B 'fast-ag':26B 'host':25B 'interfac':39B 'make':57B 'mcp':21B,34B,82B 'model':79B 'network':38B 'oper':62B,77B 'operating-system':61B 'port':41B 'python':22B 'reach':54B 'run':60B 'self':24B 'self-host':23B 'serv':30B 'server':67B 'shell':49B,70B 'start':47B 'still':74B 'system':63B 'tool':20B,83B 'use':75B 'user':68B 'without':69B","search_c":"'/mcp':128C '0.0.0.0':114C '0.7.21':104C,214C '8000':117C 'access':207C 'agent':86C,96C,107C,134C,144C 'ai':95C 'allow':120C 'authent':119C 'bound':112C 'build':91C 'call':146C 'caus':160C 'cli/commands/serve.py':191C 'client':123C,158C,174C 'command':164C 'configur':183C 'consum':177C 'context':99C 'default':187C 'defin':189C 'describ':206C 'endpoint':129C 'evalu':94C 'execut':149C 'expos':133C 'fast':85C,106C 'fast-ag':84C,105C 'fix':211C 'framework':89C 'http':110C 'implement':151C 'interact':198C 'invok':131C 'issu':209C 'local':148C 'mcp':184C 'mcp/server/agent_server.py':193C 'model':98C,181C 'network':122C 'non':197C 'non-interact':196C 'oper':162C,179C 'operating-system':161C 'permiss':200C 'port':116C 'prevent':204C 'prior':102C 'prompt':201C 'protocol':100C 'reach':126C 'remot':157C 'run':92C,166C 'serv':108C 'server':138C,169C,199C 'shell':142C,172C 'start':140C 'still':176C 'support':101C 'system':163C 'tool':135C,150C,185C 'tools/local_shell_executor.py':153C 'transport':111C 'unauthent':156C 'use':109C 'user':170C 'version':213C 'without':118C,171C","first_public_at":"2026-07-22T19:59:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102610","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102610","severity":null,"published_at":"2026-11-06T21:17:05+00:00","modified_at":"2026-11-06T21:17:05+00:00","first_seen_at":"2026-11-06T21:45:07+00:00","fetched_at":"2026-11-06T21:45:07+00:00","note":null}],"documents":[{"id":90297,"url":"https://github.com/evalstate/fast-agent/commit/ba99f89c3ec7f1ef1c8b1ebce381c12b60dfea29","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90298,"url":"https://github.com/evalstate/fast-agent/releases/tag/v0.7.21","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90299,"url":"https://github.com/evalstate/fast-agent/security/advisories/GHSA-9vhv-g5hf-m7m7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-22T19:59:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}