CVE-2026-91988: atomic-agents-stack RCE Vulnerability

CVE-2026-91988 is a remote code execution vulnerability in atomic-agents-stack that allows attackers to inject malicious commands through cleartext HTTP connections. This article covers technical details, impact analysis, and mitigation.

Published : September 18, 2026

CVE-2026-91988 Overview

CVE-2026-91988 is a remote code execution vulnerability in atomic-agents-stack versions prior to 1.1.0 . The HTTP Model Context Protocol (MCP) server-registry backend factory accepts cleartext HTTP schemes when contacting catalog endpoints. Network man-in-the-middle attackers can rewrite catalog responses to inject arbitrary command and argument values. The MCPClientPool component then spawns these attacker-controlled values as local subprocesses, executing code on the agent host. The flaw is tracked under CWE-319: Cleartext Transmission of Sensitive Information .

Critical Impact An attacker positioned on the network path between an agent and its MCP server registry can achieve arbitrary code execution on the agent host by tampering with unencrypted catalog traffic.

An attacker positioned on the network path between an agent and its MCP server registry can achieve arbitrary code execution on the agent host by tampering with unencrypted catalog traffic.

atomic-agents-stack versions prior to 1.1.0

Deployments configured with HTTP MCP server-registry backends

Agent hosts running MCPClientPool against remote catalog endpoints

2026-09-15 - CVE-2026-91988 published to the National Vulnerability Database

2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91988

Vulnerability Analysis

The vulnerability resides in the HTTP MCP server-registry backend factory of atomic-agents-stack . The factory function does not restrict registry URLs to HTTPS and accepts cleartext http:// schemes. As a result, catalog responses travel unauthenticated and unencrypted across the network.

The MCP catalog defines the servers an agent can invoke, including the command binaries and argument arrays used to spawn each server. MCPClientPool consumes this catalog and passes the returned command and argument values directly into a local subprocess launcher on the agent host. Because the transport is cleartext, any network intermediary can substitute this data.

An attacker who can intercept and modify HTTP traffic replaces legitimate command entries with an arbitrary executable and arguments. When the pool spawns the entry, the attacker's command runs with the privileges of the agent process. See the GitHub Security Advisory and the VulnCheck advisory for additional detail.

The backend factory lacks scheme validation. It should reject non-TLS URLs and require certificate verification, but neither control is applied. Cleartext transport allows tampering, and downstream code trusts registry-supplied fields as safe subprocess arguments.

Exploitation requires a network position between the agent host and the MCP registry, such as a compromised router, ARP spoofing on a shared segment, rogue Wi-Fi access point, or upstream DNS or BGP manipulation. The attacker rewrites the JSON catalog response inline to inject a malicious command entry, then waits for MCPClientPool to spawn the entry as a local subprocess.

No authentication or user interaction is required on the agent side. Exploitation code is not publicly available at this time.

Detection Methods for CVE-2026-91988

Indicators of Compromise

Outbound HTTP (port 80) requests from agent hosts to MCP registry endpoints instead of HTTPS

Unexpected child processes spawned by the atomic-agents-stack runtime that do not match approved MCP server binaries

Catalog responses containing command or argument fields referencing shells, interpreters, or download utilities such as curl , wget , bash , or powershell

Network flows to MCP registry hostnames resolving to unfamiliar IP ranges

Alert on any process descended from the agent runtime that executes a shell or scripting interpreter with network-derived arguments

Inspect HTTP traffic on egress paths for JSON payloads matching MCP catalog schemas and flag non-TLS occurrences

Baseline the expected set of MCP server command paths and alert on deviations at spawn time

Monitoring Recommendations

Enable process-creation logging on agent hosts and forward events to a centralized analytics platform

Monitor DNS resolutions and TLS-versus-cleartext ratios for MCP registry hostnames

Track version inventory of atomic-agents-stack across environments to identify hosts running versions earlier than 1.1.0

How to Mitigate CVE-2026-91988

Immediate Actions Required

Upgrade atomic-agents-stack to version 1.1.0 or later on every agent host

Audit all MCP server-registry configurations and replace http:// URLs with https:// endpoints that enforce certificate validation

Restrict outbound network access from agent hosts to a known allowlist of MCP registry endpoints

Review recent process-creation logs on agent hosts for unexpected subprocess activity

The maintainers addressed the issue in atomic-agents-stack 1.1.0 . Refer to the GitHub Security Advisory GHSA-xhcr-cqfr-m3hv for release notes and remediation guidance.

Force all MCP registry connections through HTTPS with strict certificate pinning where feasible

Route agent traffic through a trusted TLS-terminating proxy that rejects cleartext MCP catalog responses

Run agent processes under a least-privilege service account to limit the impact of arbitrary subprocess execution

Apply mandatory access controls or process allowlisting to constrain which binaries the agent runtime may spawn

Disclaimer : This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.