AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-xhcr-cqfr-m3hv: atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

highvulnerability

security

Source: GitHub Advisory DatabaseAugust 17, 2026

Summary

A vulnerability in atomic-agents-stack allows attackers on the same network to intercept and modify catalog entries when they are fetched over unencrypted HTTP connections, enabling them to inject malicious commands that the software will execute locally without any LLM involvement. The HTTP MCP server-registry backend accepts both http and https schemes, but only https provides encryption protection, and there is no default allowlist (access control list) to restrict which commands can be executed.

Solution / Mitigation

The source explicitly recommends: 'require `https` by default and gate `http://` behind a loud explicit opt-in. Defense-in-depth: allowlist the resolved command basename (or require confirmation) before any registry-sourced subprocess spawn.' The source also notes that https is currently secure because `httpx` defaults to `verify=True` (validating the server's certificate) and `follow_redirects=False`.