CVE-2026-91988: dep0we atomic-agents-stack, изтичане на данни

Описание

Оригинално описание

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.

Засегнати продукти

• dep0we atomic-agents-stack: преди 1.1.0; 1.1.0

Вид слабост

• CWE-319 Предаване на чувствителна информация в открит текст

История

Други уязвимости в dep0we atomic-agents-stack

• 8.7CVE-2026-91989
• 7.1CVE-2026-91987

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-91988
• https://nvd.nist.gov/vuln/detail/CVE-2026-91988
• https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-xhcr-cqfr-m3hv
• https://www.vulncheck.com/advisories/atomic-agents-stack-before-1.1.0-remote-code-execution-via-http-mcp