Atomic Agents Stack
Monthly
Arbitrary file read in atomic-agents-stack before 1.1.0: the optional dashboard HTTP server builds filesystem paths straight from the request path, so unauthenticated remote attackers can send '../' segments to DashboardHandler.do_GET and read files outside the intended agents_root directory. The flaw affects all versions through 1.0.0 and is fixed in 1.1.0; the dashboard is off by default and binds to loopback, but an operator-set --host of 0.0.0.0 exposes it to the LAN, and even loopback deployments are reachable via DNS rebinding or SSRF from a co-located service. No public exploit code or active exploitation has been identified at time of analysis.
Cost-guardrail bypass in atomic-agents-stack 1.0.0 and earlier lets a caller run parallel helper/delegate batches with a model identifier that is absent from the hardcoded pricing table, causing the per-batch reservation to be calculated as $0.00 and silently skipped. Because the reservation is the only defense against the documented fan-out race — where every parallel worker reads the same pre-batch on-disk cost total and each individually passes the cap check — a single batch can blow past a configured daily_cap_usd budget that the operator believes is enforced. Exploitation requires cost_guardrails enabled with daily_cap_usd set and use of an unpriced model (self-hosted Ollama/vLLM, a new provider SKU, or a steered model argument); the vendor has released 1.1.0 with a fix.
atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.
Arbitrary file read in atomic-agents-stack before 1.1.0: the optional dashboard HTTP server builds filesystem paths straight from the request path, so unauthenticated remote attackers can send '../' segments to DashboardHandler.do_GET and read files outside the intended agents_root directory. The flaw affects all versions through 1.0.0 and is fixed in 1.1.0; the dashboard is off by default and binds to loopback, but an operator-set --host of 0.0.0.0 exposes it to the LAN, and even loopback deployments are reachable via DNS rebinding or SSRF from a co-located service. No public exploit code or active exploitation has been identified at time of analysis.
Cost-guardrail bypass in atomic-agents-stack 1.0.0 and earlier lets a caller run parallel helper/delegate batches with a model identifier that is absent from the hardcoded pricing table, causing the per-batch reservation to be calculated as $0.00 and silently skipped. Because the reservation is the only defense against the documented fan-out race — where every parallel worker reads the same pre-batch on-disk cost total and each individually passes the cap check — a single batch can blow past a configured daily_cap_usd budget that the operator believes is enforced. Exploitation requires cost_guardrails enabled with daily_cap_usd set and use of an unpriced model (self-hosted Ollama/vLLM, a new provider SKU, or a steered model argument); the vendor has released 1.1.0 with a fix.
atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers to rewrite catalog responses. Attackers can inject arbitrary command and argument values that are spawned as local subprocesses by MCPClientPool to achieve code execution on the agent host.