EUVD-2026-39090Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Authenticated user can run the block (PR:L), network-reachable and low-complexity (AV:N/AC:L); resource exhaustion crosses tenant boundaries (S:C) with availability-only impact (A:H).
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionCVE.org
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions prior to 0.6.52, the Fill Text Template block is vulnerable to a Denial of Service (DoS) attack. While the backend implements a SandboxedEnvironment to prevent unauthorized attribute access (e.g., blocking __class__), it fails to limit the computational complexity or execution time of the expressions. An attacker can input computationally expensive Python/Jinja2 expressions that consume the server's CPU and memory, leading to a complete system hang or crash. In multi-tenant or self-hosted environments, this results in a complete service outage and "noisy neighbor" effects that require manual administrative intervention to recover. This issue has been fixed in version 0.6.52.
Articles & Coverage 1
AnalysisAI
Uncontrolled resource consumption in the AutoGPT platform (versions before 0.6.52) lets an authenticated user crash the server through the Fill Text Template block. The block's Jinja2 SandboxedEnvironment blocks dangerous attribute access but enforces no CPU, memory, or execution-time limits, so a crafted expression can exhaust server resources and hang or crash the host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privilege account (CVSS PR:L) that can create or run an agent graph using the Fill Text Template block - that block, which renders user-controlled Jinja2 through a SandboxedEnvironment with no execution-time or complexity limit, is the exact prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, score 7.7) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high availability impact and a changed scope - consistent with a tenant being able to degrade the whole host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated user on a shared or multi-tenant AutoGPT instance creates or edits an agent graph containing a Fill Text Template block and supplies a computationally expensive Jinja2 expression (for example one that forces enormous iteration or memory allocation). When the block executes, server CPU and memory are saturated, hanging or crashing the host and producing a service outage for all co-tenants until an administrator manually intervenes. … |
| Remediation | Upgrade to the vendor-released patch: AutoGPT platform version 0.6.52 (autogpt-platform-beta-v0.6.52), which fixes the issue per advisory GHSA-ppw9-h7rv-gwq9; download the release at https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.52. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all AutoGPT installations to identify versions prior to 0.6.52. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today