CVE-2026-91989: atomic-agents-stack Path Traversal Flaw

CVE-2026-91989 Overview

CVE-2026-91989 is a path traversal vulnerability [CWE-22] in atomic-agents-stack versions before 1.1.0. The flaw resides in the dashboard HTTP server, specifically the DashboardHandler.do_GET endpoint. Remote attackers can supply directory traversal sequences such as ../ in request paths to bypass containment checks and read arbitrary files outside the intended agents_root directory. Exploitation requires no authentication and no user interaction, and can be performed across the network.

Critical Impact
Unauthenticated remote attackers can read arbitrary files accessible to the dashboard process, exposing source code, credentials, and configuration data.

Affected Products

atomic-agents-stack versions prior to 1.1.0
Deployments exposing the dashboard HTTP server (dashboard/serve.py)
Environments where the DashboardHandler endpoint is reachable over a network

Discovery Timeline

2026-09-15 - CVE-2026-91989 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91989

Vulnerability Analysis

The vulnerability exists in the dashboard HTTP server component of atomic-agents-stack. The DashboardHandler.do_GET method serves files from an intended agents_root directory but fails to correctly normalize or contain user-supplied request paths. Attackers can traverse the file system by embedding ../ segments in URL paths.

Because the dashboard is an HTTP server, the attack surface is network-reachable. Any file that the process user can read becomes accessible, including application source, environment files, SSH keys, and system files such as /etc/passwd.

Root Cause

The root cause is insufficient path canonicalization before file access. The handler concatenates or resolves request paths against agents_root without validating that the final resolved path remains inside that directory. Path containment checks can be bypassed with ../ sequences, which is the classic pattern described in CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An attacker sends a crafted HTTP GET request to the dashboard endpoint containing directory traversal sequences. For example, a request path referencing ../../../../etc/passwd resolves outside agents_root and returns the target file's contents. No credentials, tokens, or session state are required. Full technical detail is documented in the VulnCheck Advisory: Path Traversal and the GitHub Security Advisory GHSA-rm43-82j9-r4mj.

Detection Methods for CVE-2026-91989

Indicators of Compromise

HTTP GET requests to the dashboard server containing ../, ..%2f, or %2e%2e%2f sequences in the URL path
Access log entries referencing files outside the configured agents_root directory
Successful 200 OK responses to requests that reference sensitive paths such as /etc/passwd, .env, or private keys
Anomalous outbound file reads from the atomic-agents-stack dashboard process

Detection Strategies

Parse dashboard HTTP access logs for encoded and unencoded traversal patterns and alert on matches
Correlate web server access logs with file read telemetry from the host to detect out-of-directory reads
Deploy web application firewall (WAF) rules that block traversal sequences targeting the DashboardHandler endpoint

Monitoring Recommendations

Enable verbose HTTP request logging on the dashboard listener and forward logs to a central SIEM
Monitor file access events on sensitive files such as configuration, credential, and key material for reads by the dashboard process
Alert on any successful response where the resolved path escapes the expected agents_root prefix

How to Mitigate CVE-2026-91989

Immediate Actions Required

Upgrade atomic-agents-stack to version 1.1.0 or later
Restrict network exposure of the dashboard HTTP server to trusted management networks only
Run the dashboard process under a low-privilege account with read access limited to agents_root
Review dashboard access logs for prior exploitation attempts and rotate any credentials that may have been exposed

Patch Information

The issue is fixed in atomic-agents-stack1.1.0. Refer to the GitHub Security Advisory GHSA-rm43-82j9-r4mj for the upstream fix and version metadata.

Workarounds

Place the dashboard behind an authenticating reverse proxy that rejects traversal sequences before they reach the application
Configure a WAF rule set to drop requests containing ../, ..\\, or URL-encoded equivalents
Bind the dashboard listener to 127.0.0.1 and access it only through an SSH tunnel until patching is complete

bash

# Example NGINX reverse proxy rule to block traversal sequences
location /dashboard/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 400;
    }
    proxy_pass http://127.0.0.1:8000/;
}