{"id":"GHSA-j659-8xh6-5pq5","summary":"atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard","details":"`_estimate_batch_cost` (`atomic_agents/agent.py`) looks up the per-model output price with `PRICING.get(model, {})`, returning 0.0 for any model not in the hardcoded pricing table. `_check_batch_reservation` then early-returns when the reservation is \u003c= 0, skipping the batch reservation entirely. That reservation is the only defense against the documented fan-out race where every parallel helper/delegate reads the identical pre-batch on-disk cost total and each passes its individual check even though the collective spend overruns the configured cap.\n\n**Impact:** an operator running any model not in the pricing table (self-hosted/Ollama/vLLM, a new provider SKU) with `cost_guardrails` + `daily_cap_usd` set believes the cap protects them, but a single parallel batch can blow past the cap. The parallel-helper `model` argument can also be steered to an unknown id. The sibling `dream._estimate_dream_cost` does this correctly (`PRICING.get(model, _fallback_pricing())`), which makes this a clear defect.\n\n**Affected:** `agent.py` (`_estimate_batch_cost` / `_check_batch_reservation`), all versions through 1.0.0.\n\n**Fix:** use `PRICING.get(model, _costs._fallback_pricing())['output']` (mirror dream/calc_cost). Add a conformance test asserting an unknown-model batch reserves \u003e 0 and that an over-cap unknown-model batch raises `CostGuardrailBlocked`.","aliases":["CVE-2026-91987"],"modified":"2026-09-16T03:56:06.072717965Z","published":"2026-08-17T21:50:01Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-08-17T21:50:01Z","nvd_published_at":null,"cwe_ids":["CWE-770"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/dep0we/atomic-agents-stack/security/advisories/GHSA-j659-8xh6-5pq5"},{"type":"PACKAGE","url":"https://github.com/dep0we/atomic-agents-stack"},{"type":"WEB","url":"https://github.com/dep0we/atomic-agents-stack/releases#release-v1.1.0"}],"affected":[{"package":{"name":"atomic-agents-stack","ecosystem":"PyPI","purl":"pkg:pypi/atomic-agents-stack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0"}]}],"versions":["1.0.0"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.0.0","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-j659-8xh6-5pq5/GHSA-j659-8xh6-5pq5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}