CVE-2026-85100 - Vulnerability Details

- 2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption

Description

A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-09-03

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the AgentSquad.routeRequest routine of the Streaming Agent Response Workflow component. An attacker can craft requests that cause the routine to consume excessive CPU or memory, leading to degraded performance or service unavailability. The vulnerability is purely a resource exhaustion flaw; no code execution or privilege escalation is possible.

Affected Systems

Products affected are 2FastLabs agent-squad versions up to and including 1.1.4. Any installation of 1.1.4 or earlier that executes the orchestrator module is potentially vulnerable.

Risk and Exploitability

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote via network access to the Streaming Agent Response Workflow endpoint. If the component is exposed to untrusted networks, repeated exploitation could exhaust resources and cause a denial‑of‑service condition.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

2FastLabs

agent-squad

affected

Version	Status	Constraints
`1.1.0`	affected	—
`1.1.1`	affected	—
`1.1.2`	affected	—
`1.1.3`	affected	—
`1.1.4`	affected	—

No data.

Vendor Product Confidence Versions

2fastlabs

Agent-squad

95%

Version	Status	Scheme	Platform
`1.1.0`	affected	semver	—
`1.1.1`	affected	semver	—
`1.1.2`	affected	semver	—
`1.1.3`	affected	semver	—
`1.1.4`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply any available vendor patch or update as soon as released; monitor 2FastLabs channels for patch announcements.
Place the agent behind a firewall and restrict inbound traffic to trusted hosts only or enforce strict network access controls.
Implement request throttling or rate limiting for AgentSquad.routeRequest to alleviate excessive resource consumption (mitigates CWE-400).
Configure timeouts and internal resource limits for the process or container to prevent prolonged execution and resource exhaustion (mitigates CWE-404).
Set up monitoring and alerting for abnormal CPU, memory usage, or request queue lengths to detect abuse early.

Generated by OpenCVE AI on September 3, 2026 at 13:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00522.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/2FastLabs/agent-squad/
https://github.com/2FastLabs/agent-squad/issues/661
https://github.com/hackerguopeng/cve/tree/main/Agent_Squad_Streaming_Background_DoS_Report
https://vuldb.com/cve/CVE-2026-85100
https://vuldb.com/submit/884960
https://vuldb.com/submit/884961
https://vuldb.com/vuln/398311
https://vuldb.com/vuln/398311/cti

History

Thu, 03 Sep 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 03 Sep 2026 10:00:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Title		2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption
First Time appeared		2fastlabs 2fastlabs agent-squad
Weaknesses		CWE-400 CWE-404
CPEs		cpe:2.3:a:2fastlabs:agent-squad::::::::
Vendors & Products		2fastlabs 2fastlabs agent-squad
References		https://github.com/2FastLabs/agent-squad/ https://github.com/2FastLabs/agent-squad/issues/661 https://github.com/hackerguopeng/cve/tree/main/Agent_Squad_Streaming_Background_DoS_Report https://vuldb.com/cve/CVE-2026-85100 https://vuldb.com/submit/884960 https://vuldb.com/submit/884961 https://vuldb.com/vuln/398311 https://vuldb.com/vuln/398311/cti
Metrics		cvssV2_0 `{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

2fastlabs Agent-squad

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-03T09:45:15.137Z

Updated: 2026-09-03T15:39:18.552Z

Reserved: 2026-09-03T05:04:22.233Z

Link: CVE-2026-85100

Vulnrichment

Updated: 2026-09-03T15:38:19.259Z

NVD

Status : Deferred

Published: 2026-09-03T13:06:21.060

Modified: 2026-09-03T17:25:25.113

Link: CVE-2026-85100

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-03T14:45:03Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption
CWE-404
Improper Resource Shutdown or Release

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object