Autogpt Platform
CVE-2026-24780
HIGH
GHSA-r277-3xc5-c79v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as valid platform user
-
DeliveryCall block execution endpoint with disabled BlockInstallationBlock UUID
-
ExploitWrite arbitrary Python code to filesystem
-
ExecutionExecute code via __import__()
-
ImpactRemote code execution on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated access to AutoGPT Platform prior to v0.6.44 with block execution endpoints (main web API or external API) enabled. Block execution validation must not check the |
| Impact | CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. Public exploit/POC available. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this vulnerability to create, deploy, and manage continuous artificial intelligence agents that automa. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Remote code execution in AutoGPT Platform prior to v0.6.44 allows authenticated users to execute disabled blocks and write arbitrary Python code to the server filesystem. The vulnerability stems from insufficient validation of the disabled flag in block execution endpoints, enabling attackers to achieve code execution via the BlockInstallationBlock component. Public exploit code exists, and self-hosted instances with Supabase signup enabled are particularly vulnerable to account creation and exploitation.
Earlier versions of this analysis (1)
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. [CVSS 8.8 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-94 (Code Injection). Affects Autogpt Platform. AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.44, AutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the disabled flag. Any authenticated user can execute the disabled BlockInstallationBlock, which writes arbitrary Python code to the server filesystem and executes it via `__import_
Know when Autogpt Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.44, AutoGPT Platform's block execution endpoints (both main web API and external API) allow executing blocks by UUID without checking the disabled flag. Any authenticated user can execute the disabled BlockInstallationBlock, which writes arbitrary Python code to the server filesystem and executes it via __import__(), achieving Remote Code Execution. In default self-hosted deployments where Supabase signup is enabled, an attacker can self-register; if signup is disabled (e.g., hosted), the attacker needs an existing account. autogpt-platform-beta-v0.6.44 contains a fix.
Executive ViewAI
CVE-2026-24780 is a high-severity vulnerability affecting AutoGPT deployments with no available patch and active public exploits. Organizations using AutoGPT for AI agent automation face immediate risk of unauthorized access or workflow compromise, requiring urgent mitigation actions to prevent potential data exposure or operational disruption.
Implement network segmentation to isolate AutoGPT infrastructure; deploy WAF rules to restrict AutoGPT API endpoints to authorized users only; enforce multi-factor authentication for all AutoGPT administrative access; disable unnecessary AutoGPT features and agent capabilities; increase audit logging and real-time alerting on AutoGPT activity; consider temporary operational suspension of non-critical AutoGPT agents until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)GitHub Advisory
More in Autogpt Platform
View allAutoGPT has a second SSRF vulnerability (CVSS 9.8) in a different endpoint, providing an additional path to access inter
AutoGPT has a Server-Side Request Forgery vulnerability (CVSS 9.8) allowing unauthenticated attackers to make the AI pla
AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote C
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut
AutoGPT platform versions prior to v0.6.46 expose API keys and authentication secrets in application logs due to insecur
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut
A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogp
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut
AutoGPT platform versions before 0.6.32 contain a regular expression denial of service vulnerability in the Code Extract
Remote code execution in AutoGPT prior to version 0.6.48 allows authenticated users to execute arbitrary Python code on
Disk exhaustion in AutoGPT Platform before version 0.6.32 enables denial of service through unbounded Docker container l
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut
Exploit-DB