CVE-2026-91988: atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP
atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using atomic-agents-stack before 1.1.0 are exposed when they use the HTTP MCP server-registry backend with a cleartext HTTP scheme. The attack targets the agent host where MCPClientPool spawns subprocesses.
What does an attacker need to exploit it?
An attacker needs a network man-in-the-middle position capable of rewriting responses from the cleartext HTTP catalog. No privileges or user interaction are required according to the supplied vector.
What is the impact of a successful attack?
An attacker can inject arbitrary command and argument values into catalog responses. MCPClientPool then spawns those values as local subprocesses, resulting in code execution on the agent host.
What should be prioritized for remediation?
Upgrade atomic-agents-stack to version 1.1.0 or later. Until patching is possible, avoid cleartext HTTP schemes for the HTTP MCP server-registry backend.