Cost Guardrail Bypass in Atomic Agents Stack by Dep0we
CVE-2026-91987

7.1HIGH

Key Information:

Vendor

Dep0we

Status
Atomic-agents-stack
Vendor
CVE Published:
15 September 2026

What is CVE-2026-91987?

The atomic-agents-stack prior to version 1.1.0 contains a significant vulnerability in the _estimate_batch_cost function, allowing attackers to exploit deployments using unknown model identifiers. This flaw results in zero costs being returned for these unidentified models, bypassing established daily cost limitations and potentially allowing users to exceed budget constraints during parallel batch operations. This vulnerability can lead to unintended financial consequences for organizations relying on accurate cost management.

Affected Version(s)

atomic-agents-stack 0 < 1.1.0

atomic-agents-stack 1.1.0

References

https://github.com/dep0we/atomic-agents-stack/security/ad...
vendor-advisory
https://www.vulncheck.com/advisories/atomic-agents-stack-...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.