Arbitrary Code Execution in atomic-agents-stack via MCP Registry Injection

The atomic-agents-stack library (prior to version 1.1.0) contains a vulnerability in its HTTP MCP server-registry backend factory that allows for the acceptance of unencrypted HTTP traffic. An attacker positioned to perform a man-in-the-middle (MITM) attack can intercept network traffic between the client and the registry service. By rewriting the catalog response, the attacker can supply arbitrary command and argument values. These injected parameters are subsequently processed by the MCPClientPool, which spawns them as local subprocesses. This flaw results in arbitrary code execution on the host machine running the agent, posing a significant risk to environments that rely on this library for agent-based automation and orchestration. Defenders should prioritize updating to version 1.1.0 or later to enforce secure communication and input validation for registry responses.

Impact

Successful exploitation allows for remote code execution on any host running a vulnerable version of the atomic-agents-stack library. If compromised, an attacker gains the privileges of the service account executing the agent, potentially leading to unauthorized data access, lateral movement within the environment, or full system takeover.

Recommendation

• Upgrade the atomic-agents-stack dependency to version 1.1.0 or later immediately.
• Implement network-level egress filtering and enforce TLS for all registry communication to prevent MITM interception.
• Audit logs for unexpected subprocesses spawned by the process hosting the atomic-agents-stack library.