Path Traversal Vulnerability in atomic-agents-stack

hello@craftedsignal.io — Tue, 15 Sep 2026 17:44:37 +0000

The atomic-agents-stack library, specifically versions prior to 1.1.0, contains a critical path traversal vulnerability within its dashboard HTTP server component. This vulnerability stems from improper input validation in the DashboardHandler.do_GET endpoint. Remote, unauthenticated attackers can leverage this flaw by supplying directory traversal sequences, such as "../", within the HTTP request path. By doing so, the attacker can bypass existing path containment checks designed to restrict access to the agents_root directory, effectively granting them the ability to read arbitrary files from the underlying filesystem where the application is hosted. This vulnerability poses a significant risk to the confidentiality of sensitive configuration files, environment variables, or other stored data accessible to the service process. Defenders should prioritize updating to version 1.1.0 or later to mitigate this exposure.

Impact

Successful exploitation of CVE-2026-91989 allows an attacker to read any file on the server accessible to the atomic-agents-stack process. This can lead to full disclosure of application secrets, environment configurations, and other sensitive host data. The vulnerability is highly impactful due to the ease of exploitation, requiring only unauthenticated HTTP requests to the dashboard interface.

Recommendation

Upgrade the atomic-agents-stack dependency to version 1.1.0 or later immediately.
Review web server access logs for requests containing suspicious path segments like "../" or "%2e%2e/" targeting dashboard endpoints.
Apply WAF rules to block HTTP requests containing directory traversal sequences directed at paths mapped to the dashboard component.

Arbitrary Code Execution in atomic-agents-stack via MCP Registry Injection

hello@craftedsignal.io — Tue, 15 Sep 2026 17:44:29 +0000

The atomic-agents-stack library (prior to version 1.1.0) contains a vulnerability in its HTTP MCP server-registry backend factory that allows for the acceptance of unencrypted HTTP traffic. An attacker positioned to perform a man-in-the-middle (MITM) attack can intercept network traffic between the client and the registry service. By rewriting the catalog response, the attacker can supply arbitrary command and argument values. These injected parameters are subsequently processed by the MCPClientPool, which spawns them as local subprocesses. This flaw results in arbitrary code execution on the host machine running the agent, posing a significant risk to environments that rely on this library for agent-based automation and orchestration. Defenders should prioritize updating to version 1.1.0 or later to enforce secure communication and input validation for registry responses.

Impact

Successful exploitation allows for remote code execution on any host running a vulnerable version of the atomic-agents-stack library. If compromised, an attacker gains the privileges of the service account executing the agent, potentially leading to unauthorized data access, lateral movement within the environment, or full system takeover.

Recommendation

Upgrade the atomic-agents-stack dependency to version 1.1.0 or later immediately.
Implement network-level egress filtering and enforce TLS for all registry communication to prevent MITM interception.
Audit logs for unexpected subprocesses spawned by the process hosting the atomic-agents-stack library.

Atomic-Agents-Stack (< 1.1.0) - CraftedSignal Threat Feed

Path Traversal Vulnerability in atomic-agents-stack

Impact

Recommendation

Arbitrary Code Execution in atomic-agents-stack via MCP Registry Injection

Impact

Recommendation