Threats tagged 'ghsa-9vhv-g5hf-m7m7'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.4	EPSS 0.3%	CVE-2026-102610fast-agent-mcp · fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is Medium6.4EPSS 0.3%2026-11-09GCVE DatabaseCVE-2026-102610 The fast-agent-mcp package version prior to 0.7.21 has a vulnerability where the 'fast-agent serve' command binds an HTTP server to 0.0.0.0 (all interfaces) by default without any authentication. When started with the --shell option, this allows unauthenticated remote clients to execute arbitrary operating system commands on the server, resulting in remote code execution (RCE). This affects version <0.7.21 and was fixed in version 0.7.21. EPSS 0.3%Report on CVE-2026-102610 Vulnerability CWE-306 #ghsa-9vhv-g5hf-m7m7 #pypi	GCVE Database	2026-11-09

Page 1 of 1