CVE-2026-91988

Versions of atomic-agents-stack before 1.1.0 allow the HTTP MCP server-registry backend factory to be configured with cleartext http:// URLs, so the agent fetches its MCP server catalog over an unencrypted channel. An attacker who can observe or intercept that traffic (for example, on a shared or hostile network) can act as a man-in-the-middle and rewrite the catalog response, injecting arbitrary command and argument values. Because MCPClientPool spawns entries from that catalog as local subprocesses, the injected values execute on the agent host, giving the attacker full code execution with the privileges of the agent process. This affects developers and deployments running AI agents built on atomic-agents-stack < 1.1.0 that use the HTTP registry backend over an untrusted network path. The flaw is rated critical (CVSS 4.0: 9.2), but it is not in the CISA KEV catalog, no public proof of concept is known, and no exploitation has been reported.

What to do: Upgrade atomic-agents-stack to version 1.1.0 or later, which rejects cleartext HTTP schemes in the registry backend. If upgrading is not immediately possible, ensure all MCP server-registry URLs use https://, restrict the agent host's outbound network access, and run agents in a sandboxed container with minimal privileges. Review agent logs for unexpected subprocess spawns or unfamiliar commands originating from registry catalog entries.