CVE-2026-91988 is a cleartext transport flaw in atomic-agents-stack before version 1.1.0. Its HTTP MCP server registry accepts plain http URLs, so a network attacker can rewrite the catalog and make the agent host start commands of their choosing. NVD scores it High (8.1). Upgrade to 1.1.0.
What's affected
The GitHub advisory lists atomic-agents-stack up to and including 1.0.0 as affected and 1.1.0 as patched. The NVD record says before 1.1.0.
The record lists CWE-319, cleartext transmission of sensitive information. The advisory also lists CWE-494, download of code without integrity check. The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, high complexity because the attacker must sit in the traffic path, and no login needed.
The advisory rates it High, matching the NVD level. It also says the https path is sound, because the HTTP client verifies certificates by default and does not follow redirects. The risk is limited to registries configured with an http address.
How to check if you're exposed
Search your configuration for the registry URL that your agent stack uses to load MCP server entries. If it starts with http and not https, you are in the affected case on a version of 1.0.0 or earlier. Check which release or tag of the project you deployed and compare it with 1.1.0. The advisory does not give a package manager command, so use the way you installed it.
Also look at where the agent host runs and which networks its registry traffic crosses. A registry reached over a shared or untrusted network is the risky setup. One on a loopback address is far less so.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Upgrade to atomic-agents-stack 1.1.0 or later, where https is required by default.
- Switch every registry URL to https.
- Do not enable the http opt-in described in the fix unless the traffic stays on a network you fully control.
- Add an allow list of permitted command names for registry-sourced MCP servers, as the advisory suggests for defense in depth.
Why it matters
MCP servers are often started as local subprocesses from a command and arguments. If those values come from a catalog fetched over plain http, anyone who can alter the traffic can substitute a command. The advisory stresses that no language model is involved: the host simply spawns what the catalog says.
Two defaults make it worse. The policy allow list is off by default, so every resolved entry connects. And the command and arguments are type-checked but not restricted in content. Fetching configuration that becomes code over a channel without integrity protection is the root cause. The KEV flag is false in the record.
Try it yourself
You cannot patch what you cannot list. This demo shows how a dependency inventory makes agent frameworks like this one visible.
Click through it at your own pace, or open it full screen.
Quick check
Is https enough?
The advisory says the https path is sound because certificates are verified by default. It still suggests an allow list for added protection.
Does the attacker need to influence the model?
No. The advisory says code execution happens with no language model involvement.
Sources
Last reviewed: 18 October 2026.
