Threat
NVD-CVE-2026-102610
Publication date unknown · Discovered nist.gov
Page published
Publication date unknown · First observed: 9 Nov 2026
Coverage timeline
Single-source advisory — one report is available.
Why it matters
The fast-agent vulnerability exposes agent capabilities—and potentially local command execution—to unauthenticated network clients, making upgrades to 0.7.21 and restrictions on endpoint access important for affected deployments.
CVE-2026-102610 affects fast-agent versions before 0.7.21: the serve command defaults to an unauthenticated HTTP service on 0.0.0.0:8000, allowing reachable clients to invoke the exposed agent through /mcp. With --shell enabled, clients can cause operating-system commands to execute as the server user; otherwise, they can still consume the operator's model and configured MCP tools. Version 0.7.21 fixes the issue.