---
title: Two more agent frameworks expose MCP endpoints to the network: fast-agent serve gave unauthenticated shell RCE by default, and AgentScope's MCP workspace API has an unfixed command injection | ctxsec
url: https://ctxsec.com/items/fast-agent-serve-unauthenticated-mcp-0-0-0-0-shell-rce-cve-2026-102610-agentscope
description: "fast-agent's serve command, through 0.7.20, exposed the agent over MCP on 0.0.0.0:8000 with no authentication and no warning. Started with --shell (the -x flag used in the README quickstart), any client that could reach the port could ask the agent to run commands through its execute tool; the advisory shows a stock model doing so from one plain-language request. Without --shell, an attacker can still spend the operator's model and use its configured MCP tools. Version 0.7.21 fixes it. Separately, CVE-2026-123022 says AgentScope up to 2.0.11 passes an attacker-controlled command argument to subprocess.Popen in its MCP workspace API, with a public exploit; the CVE record says the fix pull request was still awaiting acceptance."
status: "official (fast-agent GHSA-9vhv-g5hf-m7m7 / CVE-2026-102610, fixed in 0.7.21; AgentScope CVE-2026-123022 record from VulDB, fix PR pending at publication of the record); no in-the-wild exploitation reported"
published: 2026-11-09
---

> fast-agent's serve command, through 0.7.20, exposed the agent over MCP on 0.0.0.0:8000 with no authentication and no warning. Started with --shell (the -x flag used in the README quickstart), any client that could reach the port could ask the agent to run commands through its execute tool; the advisory shows a stock model doing so from one plain-language request. Without --shell, an attacker can still spend the operator's model and use its configured MCP tools. Version 0.7.21 fixes it. Separately, CVE-2026-123022 says AgentScope up to 2.0.11 passes an attacker-controlled command argument to subprocess.Popen in its MCP workspace API, with a public exploit; the CVE record says the fix pull request was still awaiting acceptance.

[← Context & Harness Attacks](/context) · [markdown](/items/fast-agent-serve-unauthenticated-mcp-0-0-0-0-shell-rce-cve-2026-102610-agentscope.md)

official (fast-agent GHSA-9vhv-g5hf-m7m7 / CVE-2026-102610, fixed in 0.7.21; AgentScope CVE-2026-123022 record from VulDB, fix PR pending at publication of the record); no in-the-wild exploitation reported

2026-11-09

### Two more agent frameworks expose MCP endpoints to the network: fast-agent serve gave unauthenticated shell RCE by default, and AgentScope's MCP workspace API has an unfixed command injection

- **fast-agent:** upgrade `fast-agent-mcp` to 0.7.21. Until then bind `--host 127.0.0.1` and don't use `--shell` on reachable hosts.
- **AgentScope:** keep the MCP workspace API off untrusted networks until a release includes PR #3448.
- **Pattern:** agent servers that default to all interfaces turn a convenience flag into remote code execution. Scan your own ranges for MCP endpoints answering `initialize` without credentials.

Sources: [fast-agent advisory GHSA-9vhv-g5hf-m7m7 (CVE-2026-102610)](https://github.com/evalstate/fast-agent/security/advisories/GHSA-9vhv-g5hf-m7m7) · [fast-agent v0.7.21 release](https://github.com/evalstate/fast-agent/releases/tag/v0.7.21) · [CVE-2026-123022 record (VulDB CNA): AgentScope MCP Workspace API command injection](https://vuldb.com/cve/CVE-2026-123022) · [AgentScope fix pull request #3448](https://github.com/agentscope-ai/agentscope/pull/3448)