EUVD-2026-30819Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed AutoGPT instance
-
DeliveryScript repeated requests to download_agent_file
-
ExploitServer writes temp file per request
-
ExecutionDisk space progressively exhausted
-
PersistDatabase and services fail with ENOSPC
-
ImpactPlatform unavailable to all users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incomplete cleanup
|
| Exploitation Conditions | The AutoGPT Platform backend must be network-reachable to the attacker and running an affected version (0.4.2 through 0.6.51) with the download_agent_file endpoint exposed; per CVSS PR:N and UI:N, no authentication and no user interaction are required, and the description confirms unauthenticated access to that endpoint in default configurations. Limiting factors are that the target must be reachable (instances bound to localhost, behind a VPN, or behind authenticated ingress are not directly exploitable from the internet), and the time-to-outage scales with the server's free disk capacity and any independent disk-cleanup or quota controls the operator may have in place. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) yields a score of 7.5 driven entirely by availability impact, and the prerequisites are minimal: any network-reachable AutoGPT Platform instance can be attacked without credentials or user interaction. No EPSS, KEV, or SSVC data was supplied in the input, so probability scoring is unavailable; however, the attack is trivially automatable (a loop calling one endpoint) and produces full backend outage, which aligns with SSVC 'automatable=yes / technical impact=total' even though that decision is not formally recorded. There is no public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-374w-2pxq-c9jp) describes the mechanism in enough detail that exploitation is essentially self-evident. Real-world priority is high for any internet-exposed AutoGPT deployment and moderate for internal/single-tenant instances where the blast radius is contained. |
| Exploit ScenarioDerived | An attacker discovers an internet-exposed AutoGPT Platform instance via Shodan or simple scanning and scripts a loop that sends repeated HTTP requests to the download_agent_file endpoint without authentication. Each request leaves a persistent temporary file on the server, and within minutes to hours - depending on provisioned disk size - the filesystem fills, the PostgreSQL database and other services begin erroring with 'No space left on device', and the entire platform becomes unavailable to all legitimate users. No public proof-of-concept is required because the attack reduces to a one-line curl-in-a-loop against a documented endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 19, 2026
Unauthenticated denial-of-service in AutoGPT Platform versions 0.4.2 through 0.6.51 allows remote attackers to exhaust server disk space by repeatedly invoking the download_agent_file endpoint, which creates temporary files that are never cleaned up. Once disk capacity is consumed, the backend database and dependent services fail with 'No space left on device' errors, taking the entire platform offline for all users. No public exploit identified at time of analysis, but the trivial nature of the attack (simple repeated HTTP requests) makes it readily reproducible.
RemediationAI
Vendor-released patch: upgrade the AutoGPT Platform to autogpt-platform-beta-v0.6.52 or later, as published at https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.52 and detailed in advisory GHSA-374w-2pxq-c9jp. If immediate upgrade is not possible, compensating controls include restricting network access to the download_agent_file endpoint via a reverse proxy or WAF rule (trade-off: legitimate agent file downloads will be blocked for unauthenticated callers), placing the entire platform behind authenticated ingress so only known users can reach the endpoint (trade-off: breaks public/anonymous agent sharing flows), aggressive rate-limiting on the endpoint per source IP (trade-off: distributed sources can still trigger the issue, and shared NAT users may be impacted), and operationally adding a tmpfiles.d or cron-based janitor to purge stale files in the platform's temp directory while monitoring disk usage with alerting before saturation occurs (trade-off: only mitigates symptoms, not the underlying leak).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AutoGPT is an open-source workflow automation platform from Significant Gravitas for building and orchestrating continuous AI agents. The flaw lies in the download_agent_file HTTP endpoint of the AutoGPT Platform backend, which materializes agent file content into temporary files on local disk to serve them, but omits the cleanup step that should remove those files after the response is sent. This maps to CWE-459 (Incomplete Cleanup), a resource-management weakness where a program fails to release or destroy resources after use - in this case, persistent files on the filesystem rather than file handles or memory. The affected CPE is cpe:2.3:a:significant-gravitas:autogpt covering all versions in the 0.4.2-0.6.51 range.
Know when Autogpt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vulnerable to an unauthenticated Denial of Service (DoS) through the server due to uncontrolled disk space consumption. The download_agent_file endpoint creates persistent temporary files for every request but fails to delete them after they are served. An unauthenticated attacker can repeatedly call this endpoint to exhaust the server's disk space, causing the database or other system services to fail due to "No space left on device" errors, rendering the entire AutoGPT Platform backend unavailable to all users. This issue has been patched in version 0.6.52.
Executive ViewAI
AutoGPT Platform versions 0.4.2-0.6.51 contain a critical vulnerability that allows any internet user to completely disable the platform through simple repeated requests, with no authentication required. An attacker can exhaust disk space within minutes, causing total service outage and affecting all users and dependent integrations. Organizations running affected versions face immediate operational risk and data access loss.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deploy rate limiting and request throttling on the download_agent_file endpoint using a reverse proxy, WAF, or API gateway; (2) Implement automated disk space monitoring with alerts and runbooks for rapid recovery; (3) Add authentication/authorization controls to the vulnerable endpoint if operationally feasible; (4) Configure aggressive temporary file cleanup policies and disk quota enforcement; (5) Establish incident response procedures to restore service within 15 minutes if disk capacity is exhausted.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in AutoGPT DoS, Deserialization, and SSRF Flaws
View all 3DOM-based cross-site scripting in AutoGPT versions prior to 0.6.62 allows remote attackers to execute arbitrary JavaScri
Resource exhaustion denial-of-service in Significant Gravitas AutoGPT versions prior to 0.6.63 allows remote unauthentic
Denial of service in Significant-Gravitas AutoGPT prior to 0.6.63 allows remote attackers to exhaust host disk space by
Denial of service in AutoGPT prior to 0.6.63 allows remote unauthenticated users to exhaust host disk space by chaining
Denial of service in AutoGPT versions prior to 0.6.63 allows remote unauthenticated attackers to exhaust disk space on t
Server-side request forgery in the AutoGPT Platform (versions prior to 0.6.52) lets an authenticated user abuse the Send
Webhook signature verification bypass in AutoGPT Platform before 0.6.70 allows unauthenticated remote attackers to trigg
Disk exhaustion denial-of-service in Significant Gravitas AutoGPT prior to version 0.6.63 allows authenticated platform
Authenticated session hijacking in Significant Gravitas AutoGPT versions 0.6.36 through 0.6.50 allows any logged-in user
Improper access control in AutoGPT’s webhook ping endpoint allows any authenticated user to enumerate other users’ webho
Memory exhaustion in AutoGPT's AITextSummarizerBlock allows authenticated users to trigger extreme resource amplificatio
Exploit-DB