The vulnerability lies in the fast-agent serve command, which, by default, binds an HTTP interface to 0.0.0.0 on port 8000 without requiring authentication. An attacker who can reach the /mcp endpoint can invoke configured tools, and if the server is started with the --shell flag, the agent can execute arbitrary operating‑system commands as the server user. This is a classic missing‑authentication flaw (CWE‑306) combined with an OS command‑injection risk (CWE‑78). The consequence is remote code execution and potential full compromise of the machine on which the agent is running, as well as exposure of the model and MCP tools if the shell is not enabled.

Affected is the fast-agent framework from evalstate. All releases prior to v0.7.21 are vulnerable. The issue was fixed in version 0.7.21, so any deployment of fast‑agent older than that version is at risk.

With a CVSS score of 6.4 the vulnerability is of moderate severity. Because the default configuration exposes the service to any network host, an attacker only needs network reach to the host’s port 8000 and no authentication to exploit the flaw. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating that there are no publicly known exploits yet. However, the lack of authentication combined with the ability to run arbitrary commands makes the attack highly impactful once exploited.