fast-agent serve: unauthenticated RCE via exposed HTTP MCP server

fast-agent's `serve` command binds an HTTP MCP server to 0.0.0.0 with no authentication by default. When started with --shell flag, this enables unauthenticated remote code execution.

Disclosed 9 November 2026 · Record updated 10 November 2026

Impact

Unauthenticated remote code execution on any host that can reach the exposed HTTP server port 8000, with commands executing as root user.

Our coverage

A servant robot stands alone in an open doorway, accepting commands from any voice in the crowded street outside, executing tasks without checking who speaks.

Vulnerabilities

Unauthenticated code execution flaw found in fast-agent serve

An advisory published on 9 November 2026 says the agent framework's MCP server listens on all network interfaces with no authentication by default.

10 Nov 2026

Sources

github.comhttps://github.com/advisories/GHSA-9vhv-g5hf-m7m7