What is GHSA-gpqc-jrqh-x9xp?

GHSA-gpqc-jrqh-x9xp is a security advisory published by GitHub Security Advisories with High severity. atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost...

Which CVE IDs does GHSA-gpqc-jrqh-x9xp cover?

GHSA-gpqc-jrqh-x9xp covers the following CVE IDs: CVE-2026-91987. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gpqc-jrqh-x9xp?

GHSA-gpqc-jrqh-x9xp has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-gpqc-jrqh-x9xpHighCVSS 6.5

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91987 →

📋 Description

atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel batch operations.

🔗 References (4)

https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-j659-8xh6-5pq5
https://nvd.nist.gov/vuln/detail/CVE-2026-91987
https://www.vulncheck.com/advisories/atomic-agents-stack-before-1.1.0-cost-guardrail-bypass-via-unknown-model
https://github.com/advisories/GHSA-gpqc-jrqh-x9xp