Executive brief
atomic-agents-stack is a Python framework for building AI agents that can spawn local subprocesses based on catalog data. Versions before 1.1.0 accept unencrypted HTTP connections to fetch command catalogs. An attacker on the network can intercept this connection and inject malicious commands into the catalog, causing the agent to execute arbitrary code locally with no user interaction required.
Technical details
The vulnerability is a cleartext transmission and code integrity check failure (CWE-319, CWE-494). The HTTP MCP server-registry backend factory in atomic_agents/mcp_registry/http.py accepts both http and https schemes without enforcing encryption by default. Catalog entries contain command and argument specifications that are type-validated but content-unrestricted; these are later spawned as local subprocess calls by MCPClientPool. A network-adjacent attacker performing a man-in-the-middle attack over cleartext HTTP can rewrite the catalog response to inject arbitrary commands and achieve code execution on the agent host. The Policy MCP allowlist is not a default mitigation (mcp_allow_fn defaults to None), so all resolved specs connect without operator-authored allowlisting. The attack requires network proximity (adjacent/MITM capability) but no authentication, LLM involvement, or user interaction. Version 1.1.0 patches by requiring HTTPS by default and gating HTTP behind explicit opt-in.
Affected products
- dep0we atomic-agents-stack before 1.1.0
Timeline
- 2026-06-10: disclosed: GitHub Security Advisory GHSA-xhcr-cqfr-m3hv published
- 2026-09-15: advisory: CVE-2026-91988 published on NVD
- 2026: patched: Version 1.1.0 patches vulnerability by requiring HTTPS by default