CVE-2026-91988: Remote Code Execution Vulnerability in atomic-agents-stack

• •CVE-2026-91988 allows remote code execution via cleartext HTTP connections.
• •Affected versions are atomic-agents-stack prior to 1.1.0; urgent patching is required.
• •Current intelligence indicates no active exploitation, but risks remain significant.

CVE-2026-91988 is a critical remote code execution vulnerability affecting atomic-agents-stack versions prior to 1.1.0. The flaw allows attackers to exploit cleartext HTTP connections in the HTTP MCP server-registry backend factory. By intercepting and modifying catalog responses, attackers can inject arbitrary commands that are executed on the agent host. This vulnerability poses a serious risk, particularly for organizations using agentic AI workflows with HTTP-based MCP registries. Although current intelligence does not indicate active exploitation, the potential for unauthorized control over agent hosts exists. Organizations are urged to upgrade to the fixed version and disable HTTP registry use. The vulnerability was published on September 15, 2026, and requires urgent remediation. Attackers could potentially manipulate automated workflows, steal secrets, or disrupt services.