Medium severity6.5NVD Advisory· Published Sep 15, 2026

CVE-2026-91987

Description

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel batch operations.

Patches

Vulnerability mechanics

References

github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-j659-8xh6-5pq5nvd
www.vulncheck.com/advisories/atomic-agents-stack-before-1.1.0-cost-guardrail-bypass-via-unknown-modelnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000