{"data":{"id":"1001e5a2-f89f-4ccb-9dbc-eef17aaad596","title":"CVE-2026-102610: fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to…","summary":"fast-agent versions prior to 0.7.21 run `fast-agent serve` with HTTP transport bound to 0.0.0.0 on port 8000 and no authentication, so any network client that can reach the /mcp endpoint can invoke the agent tool. When the server runs with --shell, that client can run operating-system commands as the server user through the local execute tool; without --shell, it can still use the operator's model and configured MCP tools.","solution":"Fixed in 0.7.21.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102610","publishedAt":"2026-11-06T21:17:05.677Z","cveId":"CVE-2026-102610","cweIds":["CWE-78","CWE-306"],"cvssScore":"6.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["fast-agent","Model Context Protocol"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"fast-agent serve unauthenticated remote command execution via /mcp endpoint","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"high","privilegesRequired":"high","userInteraction":"required","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-11-07T00:12:12.542Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-07T00:12:15.501Z","patchAvailable":null,"disclosureDate":"2026-11-06T21:17:05.677Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-115","CAPEC-88"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}