Authentication Bypass in fast-agent Framework by evalstate

CVE-2026-102610

What is CVE-2026-102610?

In the fast-agent framework prior to version 0.7.21, a critical vulnerability exists that exposes the application to unauthenticated access. The 'fast-agent serve' command runs on port 8000 without any authentication, allowing any network client to access the /mcp endpoint. This enabled unauthorized users to execute the local execute tool and run operating system commands as the server user. Even in non-shell modes, the vulnerability allows clients to interact with the operator's model and configured tools, compromising the integrity and security of the application. The issue has been addressed in version 0.7.21, which restricts access and enhances security measures.

References