CVE-2026-102610: fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution
fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/localshellexecutor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agentserver.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
fast-agentto a version that resolves this vulnerability.Fixed in 0.7.21
Event History
Frequently Asked Questions
Which deployments are exposed to remote command execution?
Deployments running a version before 0.7.21 are exposed if they use fast-agent serve with --shell and an attacker can reach the /mcp endpoint over the network. The service binds to 0.0.0.0 on port 8000 without authentication by default, allowing commands to run as the server user.
Is a server still at risk if it was not started with --shell?
Yes. Without --shell, an unauthenticated reachable client can still invoke the exposed agent tool and consume the operator's model and configured MCP tools. The described local operating-system command execution path specifically requires --shell.
Does the non-interactive server permission prompt block unauthenticated access?
No. The non-interactive server permission prompt does not prevent the described access to the /mcp endpoint.
How can I determine whether my instance is affected?
Check whether the deployment runs a fast-agent version earlier than 0.7.21 and whether it uses fast-agent serve. Also determine whether port 8000 and the /mcp endpoint are reachable by untrusted network clients, and whether the service was started with --shell.
What is the available fix?
Upgrade fast-agent to version 0.7.21, which fixes this issue.