Executive brief
atomic-agents-stack is a Python framework for building AI agents with pluggable backends. The HTTP MCP (Model Context Protocol) catalog loader accepts cleartext http:// URLs and unconditionally spawns commands specified in the downloaded catalog without validation. An attacker positioned on the network can intercept and modify the catalog response to inject arbitrary commands, achieving remote code execution on the agent host with no user interaction required.
Technical details
The vulnerability resides in atomic_agents/mcp_registry/http.py (`make_http_mcp_server_registry_backend_from_url`), which accepts both http and https schemes for catalog URLs. Catalog entries carry command and args fields that are type-validated but not content-restricted, and are later spawned as stdio subprocesses by MCPClientPool without a default allowlist (`mcp_allow_fn` defaults to None). An attacker with network-level access (e.g., compromised routing, ARP spoofing, or DNS hijacking) can perform a man-in-the-middle attack on cleartext http:// catalog fetches, rewriting the response to inject malicious command specs. When MCPClientPool attempts to connect these specs, arbitrary code executes on the agent host with the privileges of the agent process—bypassing the LLM entirely. The https path is inherently sound (httpx defaults to verify=True and follow_redirects=False). Patch version 1.1.0 (released June 10, 2026) fixes this by: (1) requiring https by default and gating http:// behind an explicit opt-in environment variable (ATOMIC_AGENTS_MCP_SERVER_REGISTRY_ALLOW_HTTP=1) for non-loopback hosts; (2) adding a command-basename allowlist (default: {npx, uvx, python, python3, node, docker}) before subprocess spawn, which operators can customize via an mcp.md ## Allowed commands section.
Affected products
- dep0we atomic-agents-stack <= 1.0.0
Timeline
- 2026-06-10: disclosed: Published by dep0we on GitHub
- 2026-06-10: patched: Version 1.1.0 released with security fixes
- 2026-08-17: advisory: GHSA-xhcr-cqfr-m3hv reviewed and published to GitHub Advisory Database