{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/atomic-agents/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["atomic-agents-stack (1.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["atomic-agents"],"content_html":"\u003cp\u003eThe atomic-agents-stack library, specifically the \u003ccode\u003emake_http_mcp_server_registry_backend_from_url\u003c/code\u003e function within \u003ccode\u003emcp_registry/http.py\u003c/code\u003e, fails to enforce secure transport protocols. The implementation permits both \u003ccode\u003ehttp\u003c/code\u003e and \u003ccode\u003ehttps\u003c/code\u003e schemes when fetching MCP catalog registry entries. Because catalog entries specify command arguments that are subsequently executed as local subprocesses by \u003ccode\u003eMCPClientPool\u003c/code\u003e, this flaw creates an RCE primitive for a Man-in-the-Middle (MITM) attacker.\u003c/p\u003e\n\u003cp\u003eAn attacker positioned on the network path between the agent host and the catalog registry can intercept the cleartext HTTP response and modify the provided \u003ccode\u003ecommand\u003c/code\u003e and \u003ccode\u003eargs\u003c/code\u003e fields. Since the default configuration for \u003ccode\u003emcp_allow_fn\u003c/code\u003e is \u003ccode\u003eNone\u003c/code\u003e, the agent does not restrict which commands are executed upon resolution. This vulnerability affects all versions of atomic-agents-stack through 1.0.0. The impact is significant as it allows arbitrary code execution on the agent host without requiring LLM-level interaction.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated network attacker to achieve remote code execution on the host running the atomic-agents-stack. This bypasses security expectations by executing commands defined by an untrusted remote catalog, potentially leading to full system compromise or lateral movement within the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate atomic-agents-stack to a patched version that mandates HTTPS and enforces explicit opt-ins for HTTP registry URLs.\u003c/li\u003e\n\u003cli\u003eImplement a mandatory allowlist function for \u003ccode\u003emcp_allow_fn\u003c/code\u003e to validate the basename of any command resolved from external registry sources before subprocess spawning.\u003c/li\u003e\n\u003cli\u003eRestrict network egress for agent hosts to only trusted, HTTPS-enabled registry endpoints to mitigate the risk of MITM interception of catalog responses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T00:47:05Z","date_published":"2026-08-18T00:47:05Z","id":"https://feed.craftedsignal.io/briefs/2026-08-atomic-agents-rce/","summary":"The atomic-agents-stack library is vulnerable to remote code execution due to insecure handling of cleartext HTTP connections for MCP registry catalogs, allowing a Man-in-the-Middle attacker to inject malicious commands.","title":"Remote Code Execution in atomic-agents-stack via Insecure MCP Registry","url":"https://feed.craftedsignal.io/briefs/2026-08-atomic-agents-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Atomic-Agents","version":"https://jsonfeed.org/version/1.1"}