JEDI-SEC | Security Research & Digital Defense

GHSA-9vhv-g5hf-m7m7: fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with –shell this is unauthenticated remote command execution

Written by

jedisec_u136k7

in

  • Severity: MEDIUM
  • CVE: CVE-2026-102610
  • Ecosystems: pip
  • Packages: fast-agent-mcp

## Summary
`fast-agent serve` exposes the agent over MCP. By default it uses HTTP transport bound to `0.0.0.0` (all interfaces) on port 8000 with **no authentication** (`auth=None`) and prints no warning. Any host that can reach the port can call the exposed `agent` tool. When the server is started with `–shell` (which is `-x`, the flag used in the README quickstart `uvx fast-agent mcp@latest -x`), the agent has a local `execute` shell tool, so an unauthenticated remote client can drive the agent into running arbitrary OS commands — unauthenticated RCE.

## Affected code
– `cli/commands/serve.py` — transport defaults to HTTP; `–host` defaults to `0.0.0.0`; port 8000.
– `mcp/server/agent_server.py` — `auth_provider = None` unless `FAST_AGENT_SERVE_OAUTH=huggingface`;
`run_async(transport=”http”, host=host, …)` with `host` defaulting to `0.0.0.0`.
– `tools/local_shell_executor.py` — the shell tool runs commands via `create_subprocess_shell`.

## Verified (live, faithful — published 0.7.20 in Docker python:3.13-slim, stock unauthenticated client)
1) Unauthenticated exposure (core defect): a client with no Authorization header completed
`initialize` and `tools/list` (-> `[‘agent’]`) against `http://HOST:8000/mcp`. Model-independent.
2) Unauthenticated RCE with `–shell`, demonstrated two ways:
– Real production model (`gpt-4o-mini`): a single plain-language message asking the agent to run
a command via its shell tool -> the model autonomously called `execute` and the comm…

Source: GitHub Security Advisories · 2026-11-09

More posts