Read the docs
TI-2026-86125 Aliases CVE-2026-102610

fast-agent serve exposes unauthenticated remote access by default

Priority LOW 28CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-78.

Summary

fast-agent before 0.7.21 binds its serve command's HTTP transport to 0.0.0.0 on port 8000 without authentication (CWE-306). Any network client that can reach the /mcp endpoint can invoke the exposed agent tool. When the server is started with --shell, this lets an unauthenticated remote client run operating system commands as the server user, and without --shell it can still use the operator's model and configured MCP tools.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.

Why it matters now

EPSS 0.00291 21st percentileScored 2026-11-07
Fix Fixed fast-agent (evalstate): 0.7.21

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
evalstatefast-agentbefore 0.7.210.7.21Patch availableCNA
  • fast-agent Vendorevalstate Affected before 0.7.21 Fixed in 0.7.21 Patch available CNA

Remediation

Upgrade fast-agent to version 0.7.21, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA fast-agent (evalstate) Fixed in 0.7.21

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-102610
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences