CVE-2026-85100 in agent-squad
Summary
by MITRE • 09/03/2026
A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified within 2FastLabs agent-squad versions up to 1.1.4 represents a significant security risk affecting the Streaming Agent Response Workflow component, specifically targeting the AgentSquad.routeRequest function located in the orchestrator.ts file of the TypeScript source code. This flaw is categorized as an uncontrolled resource consumption vulnerability, which falls under the Common Weakness Enumeration (CWE) standard as CWE-770: Allocation of Resources Without Limits or Throttling. The core technical issue stems from a lack of adequate input validation and rate limiting mechanisms within the request routing logic. When external entities submit requests to this endpoint, the system fails to enforce strict boundaries on resource allocation such as memory usage, CPU cycles, or concurrent connection limits. This deficiency allows an attacker to trigger excessive processing loads by sending a high volume of malformed or specifically crafted requests that consume disproportionate amounts of server resources without corresponding throttling controls in place.
From an operational perspective, this vulnerability enables Remote Code Execution scenarios indirectly through Denial of Service (DoS) conditions rather than direct code injection. An adversary can exploit the flaw remotely to exhaust system resources, leading to service degradation or complete unavailability for legitimate users. The impact is particularly severe because the affected component handles streaming responses, which are inherently stateful and resource-intensive operations. By saturating these streams with malicious traffic, attackers can cause latency spikes, memory leaks, or process crashes within the orchestrator layer. This aligns with MITRE ATT&CK technique T1498: Network Denial of Service, where the attacker aims to disrupt availability by consuming bandwidth or processing power. The fact that the exploit is publicly available significantly increases the risk landscape, as automated scanning tools and less sophisticated threat actors can now leverage this knowledge to launch attacks against any instances running vulnerable versions without needing custom development efforts.
The remediation strategy must prioritize immediate mitigation through architectural changes and configuration updates since the vendor has not yet issued a patch despite being notified via an issue report. Organizations should implement strict rate limiting at the network perimeter or within the application layer to cap the number of concurrent requests processed by the AgentSquad.routeRequest function. Additionally, integrating Web Application Firewalls (WAF) with rules specifically designed to detect and block anomalous traffic patterns associated with resource exhaustion attacks can provide a temporary shield until an official fix is released. It is also critical to enforce input validation on all parameters passed through this endpoint to ensure that only expected data structures are processed. Monitoring tools should be configured to alert administrators when CPU or memory usage exceeds predefined thresholds, allowing for rapid isolation of compromised instances. Until the vendor addresses the root cause in a future release, maintaining version control and applying these compensating controls is essential to preserve service integrity and prevent exploitation by malicious actors leveraging public exploit code.