What is CVE-2026-91988?

CVE-2026-91988 is a high-severity vulnerability, classified under Cleartext Transmission of Sensitive Information. CVSS score: 8.1/10. Published 2026-09-15.

How severe is CVE-2026-91988?

High severity. CVSS v3 base score is 8.1 out of 10.

CVE-2026-91988

CVE-2026-91988

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Weakness classification (CWE)

CWE-319 — Cleartext Transmission of Sensitive Information

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-91988?: CVE-2026-91988 is a high-severity vulnerability, classified under Cleartext Transmission of Sensitive Information. CVSS score: 8.1/10. Published 2026-09-15.
How severe is CVE-2026-91988?: High severity. CVSS v3 base score is 8.1 out of 10.