fast-agent: fast-agent serve binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.4 · CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

• CVE-2026-102610: 0.29% estimated exploitation activity in the next 30 days; percentile 21.88 (FIRST EPSS, 2026-11-10). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary `fast-agent serve` exposes the agent over MCP. By default it uses HTTP transport bound to `0.0.0.0` (all interfaces) on port 8000 with no authentication (`auth=None`) and prints no warning. Any host that can reach the port can call the exposed `agent` tool. When the server is started with `--shell` (which is `-x`, the flag used in the README quickstart `uvx fast-agent mcp@latest -x`), the agent has a local `execute` shell tool, so an unauthenticated remote client can drive the agent into running arbitrary OS commands — unauthenticated RCE.

Affected code - `cli/commands/serve.py` — transport defaults to HTTP; `--host` defaults to `0.0.0.0`; port 8000. - `mcp/server/agent_server.py` — `auth_provider = None` unless `FAST_AGENT_SERVE_OAUTH=huggingface`; `run_async(transport="http", host=host, ...)` with `host` defaulting to `0.0.0.0`. - `tools/local_shell_executor.py` — the shell tool runs commands via `create_subprocess_shell`.

Verified (live, faithful — published…

Published by the source

9 Nov 2026, 22:01 UTC

Last modified by the source

9 Nov 2026, 22:15 UTC

Source last checked

10 Nov 2026, 06:35 UTC

1. Revision 2 · amended · 10 Nov 2026

   Amended from osv record GHSA-9vhv-g5hf-m7m7

2. Revision 1 · created · 9 Nov 2026

   Published from ghsa record GHSA-9vhv-g5hf-m7m7

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-102610

Advisory: fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution
IDs: CVE-2026-102610, GHSA-9vhv-g5hf-m7m7
Record: https://patchnext.com/advisories/cve-2026-102610 (revision 2, source checked 10 Nov 2026, 06:35 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: fast-agent-mcp 0.7.21. A vendor fix does not mean a deployment is fixed.

## Affected components
- PyPI fast-agent-mcp: affected < 0.7.21; fixed in 0.7.21

## Suggested inspection (read-only)
- `python -m pip show fast-agent-mcp`: prints the installed version. Run with the environment that serves production active.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on fast-agent-mcp.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-9vhv-g5hf-m7m7 (GitHub-reviewed advisory GHSA-9vhv-g5hf-m7m7 lists affected ranges: PyPI fast-agent-mcp >=0 <=0.7.20)
- Verified: https://osv.dev/vulnerability/GHSA-9vhv-g5hf-m7m7 (OSV record GHSA-9vhv-g5hf-m7m7 lists affected ranges: PyPI fast-agent-mcp >=0 <0.7.21 (fixed))

Commands are suggestions: review each one before running it.