CVE-2026-91987highCWE-770

CVE-2026-91987: high-severity vulnerability in dep0we atomic-agents-stack

atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model

Published · Updated

Follow this CVE+ Monitor atomic-agents-stack+ Monitor atomic-agents-stack

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.5%
atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel batch operations.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
dep0we · atomic-agents-stack
Related CVEs — dep0we atomic-agents-stack

In the same product, most dangerous first.

CVE-2026-91989HIGHatomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.pyEPSS 1.3%CVE-2026-91988CRITICALatomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCPEPSS 0.3%