CVE-2026-91987: Allocation of Resources Without Limits or Throttling

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the estimatebatchcost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel...

PT-2026-92103

atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in...

PT-2026-92102

atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by...

atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard

estimatebatchcost atomicagents/agent.py looks up the per-model output price with PRICING.getmodel, , returning 0.0 for any model not in the hardcoded pricing table. checkbatchreservation then early-returns when the reservation is 0 and that an over-cap unknown-model batch raises...

GHSA-J659-8XH6-5PQ5 atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard

estimatebatchcost atomicagents/agent.py looks up the per-model output price with PRICING.getmodel, , returning 0.0 for any model not in the hardcoded pricing table. checkbatchreservation then early-returns when the reservation is 0 and that an over-cap unknown-model batch raises...

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

The HTTP MCP server-registry backend factory atomicagents/mcpregistry/http.py, makehttpmcpserverregistrybackendfromurl accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by...

GHSA-XHCR-CQFR-M3HV atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

The HTTP MCP server-registry backend factory atomicagents/mcpregistry/http.py, makehttpmcpserverregistrybackendfromurl accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by...

PT-2026-92101

Name of the Vulnerable Software and Affected Versions atomic-agents-stack versions prior to 1.1.0 Description A cost-guardrail bypass exists in the estimate batch cost function within atomic agents/agent.py. The function uses PRICING.getmodel, to look up per-model output prices, which returns a...

GHSA-RM43-82J9-R4MJ atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

The optional dashboard HTTP server atomicagents/dashboard/serve.py builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.saferesolveunder. Literal ../ segmen...

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

The optional dashboard HTTP server atomicagents/dashboard/serve.py builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.saferesolveunder. Literal ../ segmen...

PT-2026-80311

The optional dashboard HTTP server atomic agents/dashboard/serve.py builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.safe resolve under. Literal ../...