GHSA-XHCR-CQFR-M3HV: Remote Code Execution via Insecure HTTP MCP Server Registry in atomic-agents-stack

Vulnerability ID: GHSA-XHCR-CQFR-M3HV
CVSS Score: 8.7
Published: 2026-08-17

A critical vulnerability exists in the atomic-agents-stack package up to version 1.0.0. The HTTP Model Context Protocol (MCP) server-registry backend factory retrieves catalog metadata over cleartext HTTP by default. Because these catalogs define execution parameters ('command' and 'args') for local stdio subprocesses, a network-positioned attacker can intercept the cleartext traffic and inject arbitrary commands. This results in arbitrary remote code execution on the agent host system without requiring user interaction.

TL;DR

Unencrypted HTTP retrieval of Model Context Protocol catalogs allows Man-in-the-Middle attackers to hijack command execution payloads, resulting in arbitrary code execution on the host system.

Technical Details

• CWE ID: CWE-319, CWE-494
• Attack Vector: Network (MITM)
• CVSS v4.0: 8.7
• Impact: Remote Code Execution (RCE)
• Exploit Status: None Documented

Affected Systems

• atomic-agents-stack (pip package)
• atomic-agents-stack: <= 1.0.0 (Fixed in: 1.1.0)

Mitigation Strategies

• Upgrade to atomic-agents-stack version 1.1.0 or newer
• Implement validation policy callbacks via mcp_allow_fn
• Enforce transport-layer encryption (HTTPS) for all registries

Remediation Steps:

1. Modify pyproject.toml or requirements.txt to specify atomic-agents-stack>=1.1.0
2. Deploy the updated application to production environments
3. Audit all registry configuration endpoints and migrate http:// URLs to https://

References

• GitHub Security Advisory
• Repository Security Advisory
• Release Notes

Read the full report for GHSA-XHCR-CQFR-M3HV on our website for more details including interactive diagrams and full exploit analysis.