Unauthenticated code execution flaw found in fast-agent serve

A security advisory published on 9 November 2026 warns that the serve command in fast-agent, an open-source framework for building AI agents, exposes an agent over the network with no authentication by default. The advisory, tracked as GHSA-9vhv-g5hf-m7m7 and CVE-2026-102610, affects the fast-agent-mcp Python package and was reproduced against version 0.7.20.

According to the advisory, fast-agent serve publishes the agent as an MCP server — MCP being the Model Context Protocol, the interface agents use to expose and consume tools. The default transport is HTTP, the default bind address is 0.0.0.0, meaning every network interface rather than just the local machine, and the default port is 8000. The authentication provider is set to none unless an environment variable is used to switch on an OAuth flow. The advisory says no warning is printed when the server starts.

The practical result, the reporter said, is that any host able to reach port 8000 can call the exposed agent tool. In testing inside a Docker container running python:3.13-slim, a client sending no Authorization header completed the MCP initialize handshake and retrieved the tool list. The advisory describes this step as model-independent, meaning it does not depend on which language model the agent is configured to use.

The more serious case involves the --shell flag, abbreviated -x, which gives the agent a local shell tool that runs commands through a subprocess. The advisory notes this flag appears in the project's own README quickstart command. With the flag set, the reporter said an unauthenticated client sent a single plain-language message asking the agent to run a command through its shell tool. Using the gpt-4o-mini model, the agent called the execute tool on its own and returned the output to the caller. That output showed the process running as root, the container hostname, and the first lines of /etc/passwd, a system file listing user accounts.

The same result was reproduced without any API key by using fast-agent's passthrough model, which invokes the named tool directly from a directive in the message. The advisory adds that the server-side permission prompt, which would normally ask an operator to approve a tool call, did not block the action because serve runs in a non-interactive mode.

On impact, the advisory states that an unauthenticated client reaching the serve port controls the agent. With --shell this amounts to remote command execution as the user running the server. Without it, the reporter said, an attacker still gets unauthenticated use of the operator's language model and any other MCP servers the agent has been configured to reach. The 0.0.0.0 default, the advisory argues, makes the server reachable beyond localhost as soon as it runs on a host that is not otherwise isolated.

The reporter proposed two fixes: default the bind address to 127.0.0.1, the loopback interface, and require an explicit --host 0.0.0.0 to listen more widely; and print a prominent warning whenever the server binds a non-loopback interface without authentication. The reporter also said a full transcript and the client scripts used in testing were sent by email, and deferred the exact severity rating to the maintainers, noting that exploitation requires both serve and the shell flag. The incident record lists the status as reported.