Path Traversal Vulnerability in atomic-agents-stack

The atomic-agents-stack library, specifically versions prior to 1.1.0, contains a critical path traversal vulnerability within its dashboard HTTP server component. This vulnerability stems from improper input validation in the DashboardHandler.do_GET endpoint. Remote, unauthenticated attackers can leverage this flaw by supplying directory traversal sequences, such as "../", within the HTTP request path. By doing so, the attacker can bypass existing path containment checks designed to restrict access to the agents_root directory, effectively granting them the ability to read arbitrary files from the underlying filesystem where the application is hosted. This vulnerability poses a significant risk to the confidentiality of sensitive configuration files, environment variables, or other stored data accessible to the service process. Defenders should prioritize updating to version 1.1.0 or later to mitigate this exposure.

Impact

Successful exploitation of CVE-2026-91989 allows an attacker to read any file on the server accessible to the atomic-agents-stack process. This can lead to full disclosure of application secrets, environment configurations, and other sensitive host data. The vulnerability is highly impactful due to the ease of exploitation, requiring only unauthenticated HTTP requests to the dashboard interface.

Recommendation

• Upgrade the atomic-agents-stack dependency to version 1.1.0 or later immediately.
• Review web server access logs for requests containing suspicious path segments like "../" or "%2e%2e/" targeting dashboard endpoints.
• Apply WAF rules to block HTTP requests containing directory traversal sequences directed at paths mapped to the dashboard component.