Quick Take
- What: CVE-2026-102610 in fast-agent before 0.7.21 exposed an unauthenticated MCP server on 0.0.0.0:8000 by default, enabling remote command execution when the –shell flag was used.
- Who is affected: Developers running
fast-agent servewith the –shell (or -x) flag on non-isolated hosts prior to version 0.7.21. - What to do: Upgrade to fast-agent 0.7.21 or later immediately if you run
fast-agent serveon any network-accessible host. - Severity: CVSS 6.4 (Medium), but enables unauthenticated remote command execution as the server user when –shell is enabled.
- Fixed in: Version 0.7.21, released June 19, 2026.
In plain English
fast-agent is a developer tool for building AI agents that support the Model Context Protocol. Before version 0.7.21, when you started the agent server with the fast-agent serve command, it would listen on all network interfaces (not just your own computer) and accept connections from anyone without checking passwords or credentials. If you also used the –shell flag (which the official quickstart guide recommended), any attacker who could reach your computer over the network could send commands to the AI agent and make it run any operating system command they wanted, with the same permissions as your user account. Version 0.7.21 fixes this by only listening on your local computer by default and showing a warning if you explicitly choose to expose it to the network. If you use fast-agent as a developer tool, upgrade to 0.7.21 immediately. If you don’t use this tool, you can ignore this issue.
What happened
fast-agent is an open-source framework for building, running, and evaluating AI agents with Model Context Protocol (MCP) support. Prior to version 0.7.21, the fast-agent serve command exposed the agent over MCP using HTTP transport bound to 0.0.0.0 (all network interfaces) on port 8000 with no authentication by default.
Any network client that could reach the /mcp endpoint could invoke the exposed agent tool. When the server was started with the –shell flag (or -x, the shorthand used in the README quickstart), the agent gained access to a local execute tool implemented by tools/local_shell_executor.py. This allowed an unauthenticated remote client to cause arbitrary operating-system commands to run as the server user.
Even without the –shell flag, an unauthenticated client could still consume the operator’s configured language model and any configured MCP tools. The defaults were defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt did not prevent the described access.
The vulnerability was discovered by security researcher novice-22, who provided a proof of concept demonstrating both real-world exploitation using gpt-4o-mini and deterministic exploitation using a passthrough model. In the demonstration, an unauthenticated client with no Authorization header successfully completed initialize and tools/list operations, then invoked the shell tool to execute commands and retrieve sensitive system information, all returned to the unauthenticated caller.
What you should do
Upgrade to fast-agent version 0.7.21 or later immediately. The fixed version defaults the bind host to 127.0.0.1 (localhost only) and requires an explicit –host 0.0.0.0 opt-in for non-loopback interfaces. The update also prints a warning when binding a non-loopback interface without authentication.
If you cannot upgrade immediately, ensure that fast-agent serve is only accessible from localhost by using firewall rules or network isolation, and avoid using the –shell flag on any network-accessible deployment.
What it means
This vulnerability represents a critical misconfiguration in the default security posture of a developer tool. The combination of binding to all interfaces, lacking authentication, and providing shell access created a pathway for unauthenticated remote command execution. While the CVSS score of 6.4 reflects the requirement for the –shell flag and other preconditions, the practical impact for affected deployments was severe: complete system compromise as the server user.
The fix in version 0.7.21 follows security best practices by defaulting to the most restrictive configuration (localhost-only binding) and requiring explicit opt-in for more permissive settings, with clear warnings about the security implications.
