PT-2026-7904 · Autogpt · Autogpt

222N5 · Published 2026-02-12 · Updated 2026-03-14 · CVE-2026-26020

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions AutoGPT versions prior to 0.6.48

Description AutoGPT is a platform for creating and managing AI agents to automate workflows. An authenticated user could achieve Remote Code Execution (RCE) on the backend server. This occurred because the BlockInstallationBlock, a tool for writing and importing Python code, was marked as disabled but graph validation did not enforce this setting. By including the block as a node within a graph, users bypassed the restriction. The vulnerable component is the BlockInstallationBlock.

Recommendations Update to version 0.6.48 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-26020

GHSA-4CRW-9P35-9X54

Affected Products

Autogpt

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26020.json · Exploit
• https://github.com/Significant-Gravitas/AutoGPT/commit/062fe1aa709217136b896c8b950e0f04435afb32 · Patch
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-4crw-9p35-9x54 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26020 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26020 · Vendor Advisory
• https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.48 · Note
• https://twitter.com/Prateektomar/status/2032456714768023936 · Twitter Post
• https://twitter.com/Prateektomar/status/2032819104852345134 · Twitter Post
• https://twitter.com/TomarPrateek23/status/2030282450421842326 · Twitter Post
• https://twitter.com/TomarPrateek23/status/2030644784256434677 · Twitter Post
• https://twitter.com/CVEnew/status/2022053672331468803 · Twitter Post
• https://twitter.com/Prateektomar/status/2031369564911710447 · Twitter Post
• https://twitter.com/Prateektomar/status/2032094363703214094 · Twitter Post
• https://twitter.com/0dayPublishing/status/2023156551939232081 · Twitter Post
• https://twitter.com/Prateektomar/status/2031007185288024127 · Twitter Post