Atomic Agents Stack
Approved changes feed: RSS · Atom
cpe:2.3:a:dep0we:atomic-agents-stack:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Dep0We (47cb5c2d-36b5-5509-8e5d-f0cdffa80c4b) |
|---|---|
| Product | Atomic Agents Stack (d2c8b2d5-c2fa-55e0-a47d-9f972ff0f44d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-91989 |
vulnerable | 2026-09-16 04:32:55.622886 |
atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py
HIGH (7.5)
atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by supplying directory traversal sequences in request paths. Attackers can bypass path containment checks by including '../' segments in requests to the DashboardHandler.do_GET endpoint to access files outside the intended agents_root directory.
Published: 2026-09-15T15:18:31.038Z
Updated: 2026-09-17T19:27:51.603Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-91988 |
vulnerable | 2026-09-16 04:32:55.553261 |
atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP
HIGH (8.1)
atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.
Published: 2026-09-15T15:18:30.347Z
Updated: 2026-09-15T15:50:03.261Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-91987 |
vulnerable | 2026-09-16 04:32:55.441150 |
atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model
MEDIUM (6.5)
atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel batch operations.
Published: 2026-09-15T15:18:29.633Z
Updated: 2026-09-17T15:15:25.383Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.