CVE-2026-91988

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.

The HTTP MCP server-registry backend factory (atomic_agents/mcp_registry/http.py, make_http_mcp_server_registry_backend_from_url) accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by MCPClientPool. Over a cleartext http:// catalog URL, a network man-in-the-middle can rewrite the catalog response to inject an arbitrary command/args and obtain code execution on the agent host, with no LLM involvement. The Policy MCP allowlist is not a default mitigation (mcp_allow_fn defaults to None), so absent an operator-authored allowlist every resolved spec connects.

Affected: mcp_registry/http.py, all versions through 1.0.0. (The https path is sound: httpx defaults to verify=True, follow_redirects=False.)

Fix: require https by default and gate http:// behind a loud explicit opt-in. Defense-in-depth: allowlist the resolved command basename (or require confirmation) before any registry-sourced subprocess spawn. Document the consequence in spec/36.

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.

The HTTP MCP server-registry backend factory (atomic_agents/mcp_registry/http.py, make_http_mcp_server_registry_backend_from_url) accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by MCPClientPool. Over a cleartext http:// catalog URL, a network man-in-the-middle can rewrite the catalog response to inject an arbitrary command/args and obtain code execution on the agent host, with no LLM involvement. The Policy MCP allowlist is not a default mitigation (mcp_allow_fn defaults to None), so absent an operator-authored allowlist every resolved spec connects.

Affected: mcp_registry/http.py, all versions through 1.0.0. (The https path is sound: httpx defaults to verify=True, follow_redirects=False.)

Fix: require https by default and gate http:// behind a loud explicit opt-in. Defense-in-depth: allowlist the resolved command basename (or require confirmation) before any registry-sourced subprocess spawn. Document the consequence in spec/36.