CVE-2026-91988 atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP
Man-in-the-middle attackers can inject commands into HTTP MCP responses, leading to remote code execution on the agent host.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91988?
CVE-2026-91988 is a critical code injection vulnerability in dep0we atomic-agents-stack, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.
Weakness: CWE-319
Which versions are affected by CVE-2026-91988?
2 open source packages ship an affected version, including atomic-agents-stack.
| Package | Affected | Fixed in |
|---|---|---|
atomic-agents-stack PyPI | All versions | 1.1.0 |
atomic-agents-stack PyPI | All versions | 1.1.0 |
How do I fix CVE-2026-91988?
Upgrade atomic-agents-stack to 1.1.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-91988 being exploited?
There is no known exploitation of CVE-2026-91988 in the wild and no public exploit code.
Sources
Also known as GHSA-wr36-693x-8mgc, GHSA-xhcr-cqfr-m3hv.