HIGH 7.1 NVD
CVE-2026-91987
atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pric
atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel batch operations.
References
- https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-j659-8xh6-5pq5
- https://www.vulncheck.com/advisories/atomic-agents-stack-before-1.1.0-cost-guardrail-bypas
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-09-15 via NVD.
vulnfeed aggregates 13549 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.