CVE-2026-102610: fast-agent: unauthenticated MCP server enables RCE

Q: Is CVE-2026-102610 actively exploited?

No confirmed active exploitation of CVE-2026-102610 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-102610?

1) Upgrade fast-agent-mcp to 0.7.21 or later. 2) Until patched, run `fast-agent serve` bound to 127.0.0.1 or behind an authenticated reverse proxy or VPN, and block inbound port 8000 at host and network firewalls. 3) Do not use --shell on shared or networked hosts; run the agent in a container or sandbox with minimal privileges. 4) Review the MCP tools attached to served agents and remove any that are not needed. 5) Rotate API keys and credentials available to the process if it was ever reachable from untrusted networks. 6) Detection: search for listeners on port 8000 and unexpected inbound requests to /mcp, review logs for unexpected tool calls or execute invocations, monitor child processes spawned by the fast-agent process, and watch for unexplained spikes in model API spend.

Q: What systems are affected by CVE-2026-102610?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling agents, developer AI tooling.

Q: What is the CVSS score for CVE-2026-102610?

CVE-2026-102610 has a CVSS v3.1 base score of 6.4 (MEDIUM). The EPSS exploitation probability is 0.29%.

GHSA-9vhv-g5hf-m7m7MEDIUM

Published November 6, 2026

CISO Take

fast-agent versions up to 0.7.20 start `fast-agent serve` on 0.0.0.0:8000 over HTTP with no authentication, so anyone who can reach the /mcp endpoint can invoke the agent. If the server was launched with --shell, this becomes unauthenticated OS command execution as the server user; without --shell, attackers can still burn the operator's model budget and abuse any connected MCP tools. The 6.4 CVSS score understates the real-world risk, because the vector assumes high privileges and user interaction while the described flaw requires neither. Exploitation likelihood is currently low (EPSS 0.29%, 78th percentile), with no public exploit, no Nuclei template and no KEV listing, but exposed MCP endpoints are cheap to scan for. Upgrade to fast-agent-mcp 0.7.21 immediately, and until you can, bind the server to 127.0.0.1 or firewall port 8000, and avoid --shell on any shared or networked host.

Sources:NVDGitHub AdvisoryEPSSATLAS

What is the risk?

Medium by CVSS (6.4), but practical risk is higher for any instance exposed beyond localhost, especially one started with --shell. The default 0.0.0.0 binding with no authentication makes exposure the default state rather than a misconfiguration. Exploitation needs only network reachability to port 8000. Likelihood is low today (EPSS 0.00291, no public exploit, not in KEV), and the main limit on exposure is how many instances are actually reachable. Confidentiality, integrity and availability impact is high when --shell is enabled, and moderate (cost abuse and tool misuse) otherwise. Blast radius is unknown because dependent counts are unavailable.

How does the attack unfold?

Discovery

Attacker scans for hosts exposing port 8000 and identifies the unauthenticated /mcp endpoint of fast-agent.

AML.T0006

Initial Access

Attacker connects to /mcp without credentials and lists and invokes the exposed agent tool.

AML.T0049

Execution

Attacker prompts the agent to call the local execute tool, running OS commands as the server user when --shell is enabled.

AML.T0053

Impact

Attacker steals credentials and API keys, pivots to other systems, or exhausts the operator's model budget.

AML.T0048

Discovery

Attacker scans for hosts exposing port 8000 and identifies the unauthenticated /mcp endpoint of fast-agent.

AML.T0006

Initial Access

Attacker connects to /mcp without credentials and lists and invokes the exposed agent tool.

AML.T0049

Execution

Attacker prompts the agent to call the local execute tool, running OS commands as the server user when --shell is enabled.

AML.T0053

Impact

Attacker steals credentials and API keys, pivots to other systems, or exhausts the operator's model budget.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
fast-agent-mcp	pip	<= 0.7.20	`0.7.21`

Do you use fast-agent-mcp? You're affected.

How severe is it?

CVSS 3.1

6.4 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACHigh

PRHigh

UIRequired

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade fast-agent-mcp to 0.7.21 or later. 2) Until patched, run fast-agent serve bound to 127.0.0.1 or behind an authenticated reverse proxy or VPN, and block inbound port 8000 at host and network firewalls. 3) Do not use --shell on shared or networked hosts; run the agent in a container or sandbox with minimal privileges. 4) Review the MCP tools attached to served agents and remove any that are not needed. 5) Rotate API keys and credentials available to the process if it was ever reachable from untrusted networks. 6) Detection: search for listeners on port 8000 and unexpected inbound requests to /mcp, review logs for unexpected tool calls or execute invocations, monitor child processes spawned by the fast-agent process, and watch for unexplained spikes in model API spend.

How is it classified?

Auth BypassCode ExecutionAgentFrameworkPluginAML.T0034.002- Agentic Resource Consumption AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0112.000- Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-102610?

Is CVE-2026-102610 actively exploited?

No confirmed active exploitation of CVE-2026-102610 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-102610?

1) Upgrade fast-agent-mcp to 0.7.21 or later. 2) Until patched, run `fast-agent serve` bound to 127.0.0.1 or behind an authenticated reverse proxy or VPN, and block inbound port 8000 at host and network firewalls. 3) Do not use --shell on shared or networked hosts; run the agent in a container or sandbox with minimal privileges. 4) Review the MCP tools attached to served agents and remove any that are not needed. 5) Rotate API keys and credentials available to the process if it was ever reachable from untrusted networks. 6) Detection: search for listeners on port 8000 and unexpected inbound requests to /mcp, review logs for unexpected tool calls or execute invocations, monitor child processes spawned by the fast-agent process, and watch for unexplained spikes in model API spend.

What systems are affected by CVE-2026-102610?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP servers, tool-calling agents, developer AI tooling.

What is the CVSS score for CVE-2026-102610?

CVE-2026-102610 has a CVSS v3.1 base score of 6.4 (MEDIUM). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP serverstool-calling agentsdeveloper AI tooling

MITRE ATLAS Techniques

AML.T0034.002Agentic Resource Consumption

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0112.000Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool. When the server is started with --shell, the agent can call the local execute tool implemented by tools/local_shell_executor.py, so an unauthenticated remote client can cause operating-system commands to run as the server user; without --shell, the client can still consume the operator's model and configured MCP tools. The defaults are defined in cli/commands/serve.py and mcp/server/agent_server.py, and the non-interactive server permission prompt does not prevent the described access. This issue is fixed in version 0.7.21.

Exploitation Scenario

An attacker scans for hosts listening on port 8000 and finds a developer VM or internal server running `fast-agent serve --shell` that is bound to all interfaces. They send MCP requests to /mcp to list the agent's tools, then call the agent with a prompt that makes it use the local execute tool to run a command such as downloading a payload or opening a reverse shell. They then read environment variables and config files to steal LLM provider keys and cloud credentials, and pivot into the internal network. On instances without --shell, the attacker instead calls connected MCP tools to read data or runs large volumes of requests to exhaust the operator's model quota.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionalityPrimary CWE-306Missing Authentication for Critical FunctionalityPrimary CWE-78Improper Neutralization of Special Elements used in an OS CommandPrimary CWE-78Improper Neutralization of Special Elements used in an OS CommandPrimary CWE-306Missing Authentication for Critical Functionality CWE-78Improper Neutralization of Special Elements used in an OS Command

CWE-306 — Missing Authentication for Critical Functionality: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.