The atomic-agents-stack before version 1.1.0 accepts cleartext HTTP connections in its MCP server-registry backend factory. This design flaw permits network-based man-in-the-middle attackers to intercept and modify catalog responses. By rewriting these responses, attackers can inject arbitrary command and argument values that MCPClientPool subsequently spawns as local subprocesses. This results in remote code execution on the affected agent host. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity.

Successful exploitation allows unauthenticated network attackers to execute arbitrary code on the agent host by injecting commands through manipulated catalog responses. This compromises the confidentiality, integrity, and availability of the affected system, potentially leading to full system compromise.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid deploying affected versions or restrict network access to prevent man-in-the-middle attacks.