CVE-2026-91987CWE-770denial-of-service

CVE-2026-91987

Medium · published September 15, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel batch operations.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00476 · 40.1th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-15T20:17Z
References (2)
https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-j659-8xh6-5pq5 · [email protected]https://www.vulncheck.com/advisories/atomic-agents-stack-before-1.1.0-cost-guardrail-bypass-via-unknown-model · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 15 SEP 15:18Z
    atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model
    cvelistv5