CVE-2026-102610: fast-agent Unauthenticated RCE Vulnerability

# CVE-2026-102610: fast-agent Unauthenticated RCE Vulnerability

https://gcdradar.vercel.app/incidents/cve-2026-102610-fast-agent-unauthenticated-rce-vulnerability · AIR-2026-1814 · closed 2026-11-06

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Disclosed vulnerability with a vendor fix and no confirmed wild exploitation.
- Fix status: Patched
- First reported: 2026-11-06
- AI role: Attack on AI
- Products: fast-agent
- CVE ids: CVE-2026-102610
- CVSS: 6.4

## Summary

Prior to 0.7.21, the fast-agent framework uses HTTP transport bound to 0.0.0.0 without authentication, allowing remote clients to invoke exposed agent tools. When started with the shell option, unauthenticated remote clients can achieve arbitrary operating system command execution.

## What to do

Update fast-agent to version 0.7.21 or later.

## Affected and fixed versions

- Affected: fast-agent < 0.7.21
- Fixed in: fast-agent 0.7.21

## Latest updates

- 2026-11-06: CVE-2026-102610: fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. (https://nvd.nist.gov/vuln/detail/CVE-2026-102610)

## Sources

- 2026-11-06 NVD: CVE-2026-102610: fast-agent is a framework for building, running, and evaluating AI agents with Model Context Protocol support. https://nvd.nist.gov/vuln/detail/CVE-2026-102610

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.