Two more agent frameworks expose MCP endpoints to the network: fast-agent serve gave unauthenticated shell RCE by default, and AgentScope's MCP workspace API has an unfixed command injection

official (fast-agent GHSA-9vhv-g5hf-m7m7 / CVE-2026-102610, fixed in 0.7.21; AgentScope CVE-2026-123022 record from VulDB, fix PR pending at publication of the record); no in-the-wild exploitation reported2026-11-09

Two more agent frameworks expose MCP endpoints to the network: fast-agent serve gave unauthenticated shell RCE by default, and AgentScope's MCP workspace API has an unfixed command injection

fast-agent: upgrade fast-agent-mcp to 0.7.21. Until then bind --host 127.0.0.1 and don't use --shell on reachable hosts.
AgentScope: keep the MCP workspace API off untrusted networks until a release includes PR #3448.
Pattern: agent servers that default to all interfaces turn a convenience flag into remote code execution. Scan your own ranges for MCP endpoints answering initialize without credentials.

Sources: fast-agent advisory GHSA-9vhv-g5hf-m7m7 (CVE-2026-102610) · fast-agent v0.7.21 release · CVE-2026-123022 record (VulDB CNA): AgentScope MCP Workspace API command injection · AgentScope fix pull request #3448