GitHub discloses unauthenticated remote command execution in fast-agent-mcp

GitHub published a medium-severity security advisory on November 9, 2026, disclosing that the fast-agent-mcp Python framework for building MCP-based AI agents exposes an unauthenticated path to remote command execution. The advisory, fast-agent-mcp unauthenticated remote command execution, explains that the project's serve command binds an HTTP server to every network interface without requiring authentication.

What changed

• GHSA-9vhv-g5hf-m7m7 (CVE-2026-102610) was published to the GitHub Advisory Database on November 9, 2026
• It affects fast-agent-mcp pip package versions up to and including 0.7.20, with a fix shipped in 0.7.21
• The severity is rated Medium with a CVSS score of 6.4
• Running fast-agent serve binds an HTTP server to 0.0.0.0 with no authentication by default
• When started with the documented --shell flag, any remote host that can reach the port can call the exposed agent tool to run arbitrary OS commands
• The flaw is classified under CWE-78 (OS command injection) and CWE-306 (missing authentication for a critical function)

What it means for AI builders

An unauthenticated path to remote command execution in a widely used MCP agent framework is a direct risk for anyone who deployed fast-agent-mcp's server mode without putting it behind a firewall or an authentication layer. Because the HTTP server binds to every interface by default, a deployment reachable from an untrusted network can let an outside client trigger the exposed agent tool and run operating system commands on the host.

Fix and mitigation

The issue is resolved in fast-agent-mcp version 0.7.21, and projects running fast-agent serve, especially with the --shell flag enabled, should upgrade to that release. Until an upgrade is in place, teams should keep the server off public interfaces and restrict network access to the exposed port.

Sources

• fast-agent-mcp unauthenticated remote command execution (CVE-2026-102610) (GitHub Security Advisories, November 9, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.