GHSA-xhcr-cqfr-m3hv: Pip/atomic-agents-stack vulnerability
The HTTP MCP server-registry backend factory (atomicagents/mcpregistry/http.py, makehttpmcpserverregistrybackendfromurl) accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by MCPClientPool. Over a cleartext http:// catalog URL, a network man-in-the-middle can rewrite the catalog response to inject an arbitrary command/args and obtain code execution on the agent host, with no LLM involvement. The Policy MCP allowlist is not a default mitigation (mcpallowfn defaults to None), so absent an operator-authored allowlist every resolved spec connects.
Affected: mcpregistry/http.py, all versions through 1.0.0. (The https path is sound: httpx defaults to verify=True, followredirects=False.)
Fix: require https by default and gate http:// behind a loud explicit opt-in. Defense-in-depth: allowlist the resolved command basename (or require confirmation) before any registry-sourced subprocess spawn. Document the consequence in spec/36.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/atomic-agents-stackto a version that resolves this vulnerability.Fixed in 1.1.0 - Upgrade
Upgrade
mcp_registry/http.pyto a version that resolves this vulnerability.Fixed in 1.0.0 - Configuration
Modify make_http_mcp_server_registry_backend_from_url to accept only https catalog URLs by default, and require an explicit, loud opt-in to allow http:// (cleartext) schemes.
mcp_registry/http.py (HTTP MCP server-registry backend factory: make_http_mcp_server_registry_backend_from_url) default_catalog_url_scheme_policy = require https by default; gate http:// behind loud explicit opt-in - Compensating control
Before any registry-sourced subprocess spawn by MCPClientPool, apply defense-in-depth: allowlist the resolved command basename (or require explicit confirmation) so that only permitted command binaries can be executed from catalog entry command/args.
- Operational
Document the consequence of the vulnerability and the new behavior/mitigations in spec/36 as part of the remediation rollout.
Event History
Frequently Asked Questions
What is the severity of GHSA-xhcr-cqfr-m3hv?
The severity of GHSA-xhcr-cqfr-m3hv is rated at 85.
How do I fix GHSA-xhcr-cqfr-m3hv?
To fix GHSA-xhcr-cqfr-m3hv, ensure to restrict the accepted command and arguments in the HTTP MCP server-registry backend.
Who is affected by GHSA-xhcr-cqfr-m3hv?
Users of the pip/atomic-agents-stack software that utilizes the HTTP MCP server-registry backend are affected by GHSA-xhcr-cqfr-m3hv.
What functions are impacted by GHSA-xhcr-cqfr-m3hv?
The function impacted by GHSA-xhcr-cqfr-m3hv is make_http_mcp_server_registry_backend_from_url in atomic_agents/mcp_registry/http.py.
What types of schemes does GHSA-xhcr-cqfr-m3hv accept?
GHSA-xhcr-cqfr-m3hv accepts both http and https schemes.