CVE-2026-91988 in atomic-agents-stack
Summary
by MITRE • 09/15/2026
atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified within atomic-agents-stack versions prior to 1.1.0 stems from a critical misconfiguration in the HTTP Model Context Protocol server-registry backend factory. Specifically, the system fails to enforce secure transport protocols when communicating with external registry services. By accepting cleartext HTTP schemes instead of requiring HTTPS, the application leaves its communication channel vulnerable to interception and modification by network-based attackers positioned within the same local area network or capable of performing man-in-the-middle attacks on the traffic path. This lack of encryption and integrity verification allows an adversary to intercept the catalog responses returned by the registry backend without detection.
Once a successful man-in-the-middle position is established, the attacker can rewrite these catalog responses with malicious content. The core technical flaw lies in how the MCPClientPool processes these retrieved configurations. When the client pool receives the manipulated response, it parses the injected data and subsequently spawns local subprocesses based on the command and argument values contained within that data. Because there are no sufficient validation checks or sandboxing mechanisms to restrict what commands can be executed by these spawned processes, an attacker who has modified the registry response can dictate exactly which system binaries run with elevated privileges of the agent host user context.
The operational impact of this vulnerability is severe, resulting in arbitrary code execution on the agent host machine. An adversary does not need direct access to the server; they only require network-level visibility and the ability to manipulate traffic between the atomic-agents-stack instance and its registry service. By injecting specific payloads into the catalog response, such as pointing command fields to system utilities like /bin/sh or powershell with malicious arguments, the attacker gains full control over the underlying operating environment of the agent host. This can lead to complete compromise of the infrastructure, data exfiltration, lateral movement within the network, and persistence mechanisms being established by the threat actor.
This vulnerability aligns closely with CWE-319, which describes cleartext transmission of sensitive information over a protected channel that is not actually protected due to protocol misconfiguration or lack of enforcement. Furthermore, from an offensive security perspective, this attack vector maps directly to MITRE ATT&CK technique T1071, Application Layer Protocol, specifically the sub-technique for Web Protocols where attackers manipulate legitimate application traffic to execute malicious commands. It also relates to CWE-94, Improper Control of Generation of Code, as the system generates and executes code based on untrusted input derived from network responses without adequate sanitization or validation.
To mitigate this risk, organizations must immediately upgrade atomic-agents-stack to version 1.1.0 or later where these security controls have been addressed. In environments where upgrading is not instantly feasible, administrators should implement strict firewall rules that restrict communication between the agent hosts and registry services to trusted IP addresses only, thereby reducing the attack surface for man-in-the-middle attacks. Additionally, deploying network intrusion detection systems capable of identifying anomalous HTTP traffic patterns or unauthorized subprocess spawns can provide early warning indicators of exploitation attempts. Ensuring all internal service-to-service communications utilize TLS with proper certificate validation is essential to prevent such registry poisoning attacks in distributed agent architectures.