The flaw lies in the HTTP MCP server‑registry backend factory, where cleartext HTTP URLs are accepted. This permits an attacker who can perform a man‑in‑the‑middle on the network to modify catalog responses and inject command‑line arguments. The injected arguments are executed by the MCPClientPool as local subprocesses, effectively giving the attacker command execution on the agent host. The weakness is a CWE‑319: Cleartext Transmission of Sensitive Information, which in this context enables remote code execution. The detailed attack path—how a man‑in‑the‑middle rewrites catalog responses—is inferred from the description but is not explicitly documented in the advisory.

This vulnerability affects dep0we’s atomic‑agents‑stack products that are versioned before 1.1.0. Any instance running an older version at the time of the advisory is potentially vulnerable.

The CVSS base score of 9.2 denotes critical severity. The EPSS score is less than 1%, and the flaw is not listed in CISA KEV, indicating limited current exploitation activity. Exploitation requires network proximity and the ability to intercept traffic to the MCP server—a typical MITM scenario. Because the vulnerability is exploited via cleartext HTTP, an attacker can rewrite catalog responses, inject arbitrary commands, and have those commands run with the agent’s privileges. These steps are inferred from the description; the advisory does not provide an explicit proof‑of‑concept.