PT-2026-41761 · Autogpt · Autogpt

CVE-2026-33232 · Published 2026-05-19 · Updated 2026-05-19

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions AutoGPT versions 0.4.2 through 0.6.51

Description Unauthenticated Denial of Service (DoS) is possible due to uncontrolled disk space consumption. The 'download agent file' endpoint creates persistent temporary files for every request but does not delete them after they are served. An attacker can repeatedly call this endpoint to exhaust the server's disk space, leading to "No space left on device" errors that cause the database or other system services to fail, rendering the backend unavailable to all users.

Recommendations Update to version 0.6.52. Restrict access to the 'download agent file' endpoint as a temporary mitigation measure.

Exploit

Fix

DoS

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

CWE-459

Related Identifiers

CVE-2026-33232

GHSA-374W-2PXQ-C9JP

Affected Products

Autogpt

References · 9

• 🔥 https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-374w-2pxq-c9jp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33232.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-33232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33232 · Security Note
• https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.52 · Note
• https://t.me/CVEtracker/54184 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2056571309740405219 · Twitter Post
• https://t.me/cveNotify/163957 · Telegram Post
• https://twitter.com/CVEnew/status/2056670111575277808 · Twitter Post