CVE-2026-102610: fast-agent unauthenticated remote code execution in serve

CVE-2026-102610 · Severity: medium · CVSS 6.4 · Published 2026-11-06

fast-agent is an AI agent framework that can expose a server for running and evaluating agents. Prior to version 0.7.21, the serve command by default binds to all network interfaces (0.0.0.0) without authentication, allowing any remote attacker to invoke agent tools. When the --shell flag is enabled, unauthenticated attackers can execute arbitrary operating-system commands on the server as the user running fast-agent, leading to complete system compromise.

Vendors: PyPI.

Quick answers

Is CVE-2026-102610 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-102610 being exploited in the wild.
How severe is CVE-2026-102610?
Medium severity, with a CVSS score of 6.4, published 6 November 2026.
Which products and versions are affected?
Evalstate Fast-Agent before 0.7.21; fast-agent-mcp (PyPI) <= 0.7.20, ECOSYSTEM:introduced=0,fixed=0.7.21.
Is there a fix for CVE-2026-102610?
Yes. fast-agent-mcp (PyPI): upgrade to 0.7.21 or later. Until then: When using versions prior to 0.7.21, do not enable the --shell flag in production, and ensure the serve command is only accessible from trusted networks by restricting network access at the firewall or network layer to port 8000. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102610 attacked?
It is attacked over the network.
Am I affected by CVE-2026-102610?
Check whether you run Evalstate Fast-Agent or fast-agent-mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • fast-agent-mcp (PyPI): upgrade to 0.7.21 or later
    pip install "fast-agent-mcp>=0.7.21"

When using versions prior to 0.7.21, do not enable the --shell flag in production, and ensure the serve command is only accessible from trusted networks by restricting network access at the firewall or network layer to port 8000.

Technical details

The vulnerability is an authentication bypass in the HTTP server implementation (cli/commands/serve.py and mcp/server/agent_server.py). The server listens on 0.0.0.0:8000 without authentication checks, allowing unauthenticated network clients to reach the /mcp endpoint and invoke agent tools. When --shell is enabled, the local_shell_executor.py tool allows arbitrary command execution; without --shell, attackers can still consume the operator's model resources and invoke configured MCP tools. The fix changes the default bind address to 127.0.0.1 and adds warnings for remote-facing binds.

Affected products

  • evalstate fast-agent before 0.7.21

Identifiers

  • CVE-2026-102610
  • GHSA-9vhv-g5hf-m7m7

Timeline

  • 2026-11-06: disclosed
  • 2026-06-19: patched: Version 0.7.21 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.