Significant-Gravitas AutoGPT up to 0.6.58 External API execute allocation of resources

Summaryinfo

A vulnerability marked as problematic has been reported in Significant-Gravitas AutoGPT up to 0.6.58. Impacted is an unknown function of the file /api/blocks/{block_id}/execute of the component External API. Performing a manipulation results in allocation of resources. This vulnerability is cataloged as CVE-2026-45023. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Significant-Gravitas AutoGPT up to 0.6.58. This affects an unknown code of the file /api/blocks/{block_id}/execute of the component External API. The manipulation with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on integrity, and availability. The summary by CVE is:

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.59, POST /api/blocks/{block_id}/execute endpoint executes blocks without consuming any credits, regardless of the user's balance. The credit check that exists in the graph execution path (manager.py) is never reached when blocks are called directly via the external API, allowing unlimited free execution of all blocks. This vulnerability is fixed in 0.6.59.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-45023 since 05/08/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 0.6.59 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Significant-Gravitas

Name

• AutoGPT

Version

• 0.6.0
• 0.6.1
• 0.6.2
• 0.6.3
• 0.6.4
• 0.6.5
• 0.6.6
• 0.6.7
• 0.6.8
• 0.6.9
• 0.6.10
• 0.6.11
• 0.6.12
• 0.6.13
• 0.6.14
• 0.6.15
• 0.6.16
• 0.6.17
• 0.6.18
• 0.6.19
• 0.6.20
• 0.6.21
• 0.6.22
• 0.6.23
• 0.6.24
• 0.6.25
• 0.6.26
• 0.6.27
• 0.6.28
• 0.6.29
• 0.6.30
• 0.6.31
• 0.6.32
• 0.6.33
• 0.6.34
• 0.6.35
• 0.6.36
• 0.6.37
• 0.6.38
• 0.6.39
• 0.6.40
• 0.6.41
• 0.6.42
• 0.6.43
• 0.6.44
• 0.6.45
• 0.6.46
• 0.6.47
• 0.6.48
• 0.6.49
• 0.6.50
• 0.6.51
• 0.6.52
• 0.6.53
• 0.6.54
• 0.6.55
• 0.6.56
• 0.6.57
• 0.6.58

Website

• Product: https://github.com/Significant-Gravitas/AutoGPT/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion