Is CVE-2026-91988 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91988 being exploited in the wild.

How severe is CVE-2026-91988?

High severity, with a CVSS score of 8.1, published 15 September 2026.

Which products and versions are affected?

atomic-agents-stack (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.0.

Is there a fix for CVE-2026-91988?

Yes. atomic-agents-stack (PyPI): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91988 attacked?

It is attacked over the network or from the adjacent network.

Am I affected by CVE-2026-91988?

Check whether you run atomic-agents-stack (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91988: atomic-agents-stack cleartext HTTP MCP registry remote code execution

CVE-2026-91988 · Severity: high · CVSS 8.1 · Published 2026-09-15

atomic-agents-stack is a Python framework for building AI agents that can spawn local subprocesses based on catalog data. Versions before 1.1.0 accept unencrypted HTTP connections to fetch command catalogs. An attacker on the network can intercept this connection and inject malicious commands into the catalog, causing the agent to execute arbitrary code locally with no user interaction required.

Technologies: atomic-agents-stack (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-91988 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91988 being exploited in the wild.
How severe is CVE-2026-91988?: High severity, with a CVSS score of 8.1, published 15 September 2026.
Which products and versions are affected?: atomic-agents-stack (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.0.
Is there a fix for CVE-2026-91988?: Yes. atomic-agents-stack (PyPI): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91988 attacked?: It is attacked over the network or from the adjacent network.
Am I affected by CVE-2026-91988?: Check whether you run atomic-agents-stack (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

atomic-agents-stack (PyPI): upgrade to 1.1.0 or later
```
pip install "atomic-agents-stack>=1.1.0"
```

Technical details

The vulnerability is a cleartext transmission and code integrity check failure (CWE-319, CWE-494). The HTTP MCP server-registry backend factory in atomic_agents/mcp_registry/http.py accepts both http and https schemes without enforcing encryption by default. Catalog entries contain command and argument specifications that are type-validated but content-unrestricted; these are later spawned as local subprocess calls by MCPClientPool. A network-adjacent attacker performing a man-in-the-middle attack over cleartext HTTP can rewrite the catalog response to inject arbitrary commands and achieve code execution on the agent host. The Policy MCP allowlist is not a default mitigation (mcp_allow_fn defaults to None), so all resolved specs connect without operator-authored allowlisting. The attack requires network proximity (adjacent/MITM capability) but no authentication, LLM involvement, or user interaction. Version 1.1.0 patches by requiring HTTPS by default and gating HTTP behind explicit opt-in.

Affected products

dep0we atomic-agents-stack before 1.1.0

Identifiers

CVE-2026-91988
GHSA-xhcr-cqfr-m3hv

Timeline

2026-06-10: disclosed: GitHub Security Advisory GHSA-xhcr-cqfr-m3hv published
2026-09-15: advisory: CVE-2026-91988 published on NVD
2026: patched: Version 1.1.0 patches vulnerability by requiring HTTPS by default

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.