CVE-2026-91989

atomic-agents-stack before 1.1.0 ships a dashboard HTTP server whose DashboardHandler.do_GET endpoint fails to properly contain requested paths within the intended agents_root directory. A remote, unauthenticated attacker can send HTTP GET requests containing '../' directory traversal sequences to escape the agents_root directory and read arbitrary files accessible to the process running the dashboard, such as configuration files, source code, credentials, or environment secrets. Anyone running an affected version with the dashboard reachable over the network (rather than bound to localhost) is exposed, with high confidentiality impact but no integrity or availability impact per the CVSS 4.0 vector (8.7). The flaw is tracked as CWE-22 and was reported through VulnCheck's disclosure program. There is no known public proof of concept, it does not appear in CISA's KEV catalog, and no exploitation has been observed in the wild.

What to do: Upgrade atomic-agents-stack to version 1.1.0 or later, which fixes the path containment bypass. Until patched, bind the dashboard to localhost or restrict it with firewall rules so it is not reachable by untrusted networks, and run it under a low-privileged account to limit what an attacker can read. Review dashboard access logs for GET requests containing '../' traversal segments as an indicator of attempted exploitation.