CVE-2026-91988: atomic-agents-stack RCE Vulnerability

CVE-2026-91988 Overview

CVE-2026-91988 is a remote code execution vulnerability in atomic-agents-stack versions prior to 1.1.0. The HTTP Model Context Protocol (MCP) server-registry backend factory accepts cleartext HTTP schemes when contacting catalog endpoints. Network man-in-the-middle attackers can rewrite catalog responses to inject arbitrary command and argument values. The MCPClientPool component then spawns these attacker-controlled values as local subprocesses, executing code on the agent host. The flaw is tracked under CWE-319: Cleartext Transmission of Sensitive Information.

Critical Impact
An attacker positioned on the network path between an agent and its MCP server registry can achieve arbitrary code execution on the agent host by tampering with unencrypted catalog traffic.

Affected Products

atomic-agents-stack versions prior to 1.1.0
Deployments configured with HTTP MCP server-registry backends
Agent hosts running MCPClientPool against remote catalog endpoints

Discovery Timeline

2026-09-15 - CVE-2026-91988 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91988

Vulnerability Analysis

The vulnerability resides in the HTTP MCP server-registry backend factory of atomic-agents-stack. The factory function does not restrict registry URLs to HTTPS and accepts cleartext http:// schemes. As a result, catalog responses travel unauthenticated and unencrypted across the network.

The MCP catalog defines the servers an agent can invoke, including the command binaries and argument arrays used to spawn each server. MCPClientPool consumes this catalog and passes the returned command and argument values directly into a local subprocess launcher on the agent host. Because the transport is cleartext, any network intermediary can substitute this data.

An attacker who can intercept and modify HTTP traffic replaces legitimate command entries with an arbitrary executable and arguments. When the pool spawns the entry, the attacker's command runs with the privileges of the agent process. See the GitHub Security Advisory and the VulnCheck advisory for additional detail.

Root Cause

The backend factory lacks scheme validation. It should reject non-TLS URLs and require certificate verification, but neither control is applied. Cleartext transport allows tampering, and downstream code trusts registry-supplied fields as safe subprocess arguments.

Attack Vector

Exploitation requires a network position between the agent host and the MCP registry, such as a compromised router, ARP spoofing on a shared segment, rogue Wi-Fi access point, or upstream DNS or BGP manipulation. The attacker rewrites the JSON catalog response inline to inject a malicious command entry, then waits for MCPClientPool to spawn the entry as a local subprocess.

No authentication or user interaction is required on the agent side. Exploitation code is not publicly available at this time.

Detection Methods for CVE-2026-91988

Indicators of Compromise

Outbound HTTP (port 80) requests from agent hosts to MCP registry endpoints instead of HTTPS
Unexpected child processes spawned by the atomic-agents-stack runtime that do not match approved MCP server binaries
Catalog responses containing command or argument fields referencing shells, interpreters, or download utilities such as curl, wget, bash, or powershell
Network flows to MCP registry hostnames resolving to unfamiliar IP ranges

Detection Strategies

Alert on any process descended from the agent runtime that executes a shell or scripting interpreter with network-derived arguments
Inspect HTTP traffic on egress paths for JSON payloads matching MCP catalog schemas and flag non-TLS occurrences
Baseline the expected set of MCP server command paths and alert on deviations at spawn time

Monitoring Recommendations

Enable process-creation logging on agent hosts and forward events to a centralized analytics platform
Monitor DNS resolutions and TLS-versus-cleartext ratios for MCP registry hostnames
Track version inventory of atomic-agents-stack across environments to identify hosts running versions earlier than 1.1.0

How to Mitigate CVE-2026-91988

Immediate Actions Required

Upgrade atomic-agents-stack to version 1.1.0 or later on every agent host
Audit all MCP server-registry configurations and replace http:// URLs with https:// endpoints that enforce certificate validation
Restrict outbound network access from agent hosts to a known allowlist of MCP registry endpoints
Review recent process-creation logs on agent hosts for unexpected subprocess activity

Patch Information

The maintainers addressed the issue in atomic-agents-stack1.1.0. Refer to the GitHub Security Advisory GHSA-xhcr-cqfr-m3hv for release notes and remediation guidance.

Workarounds

Force all MCP registry connections through HTTPS with strict certificate pinning where feasible
Route agent traffic through a trusted TLS-terminating proxy that rejects cleartext MCP catalog responses
Run agent processes under a least-privilege service account to limit the impact of arbitrary subprocess execution
Apply mandatory access controls or process allowlisting to constrain which binaries the agent runtime may spawn

bash

# Configuration example: enforce HTTPS for MCP registry endpoints
# Replace any http:// scheme with https:// in your agent configuration
export MCP_REGISTRY_URL="https://registry.example.com/mcp"
export MCP_REQUIRE_TLS=1
export MCP_VERIFY_CERT=1