AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-102610mediumBroken access control2026-11-06

CVE-2026-102610: fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP trans

fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support.

01.

What it is

fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. Prior to 0.7.21, fast-agent serve uses HTTP transport bound to 0.0.0.0 on port 8000 without authentication, allowing any network client that can reach the /mcp endpoint to invoke the exposed agent tool.

02.

How to check

  1. Affected: fast-agent before 0.7.21 (fast-agent serve over HTTP).
03.

How to fix

  1. Upgrade fast-agent to 0.7.21 or later.
  2. Until then, do not expose fast-agent serve on 0.0.0.0, and avoid --shell on reachable hosts.
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.