CVE-2026-33232
HighSummary
AutoGPT, a workflow automation platform, is vulnerable to an unauthenticated Denial of Service (DoS) attack in versions 0.4.2 through 0.6.51. An attacker can exploit the download_agent_file endpoint to uncontrollably consume disk space, leading to system failures.
Risk Assessment
The organization may experience downtime of the AutoGPT platform, affecting service availability for users. If disk space is exhausted, database services and others may fail.
Recommendation
It is recommended to upgrade to version 0.6.52, which includes fixes for this vulnerability. Additionally, monitoring disk space usage on the server is advisable.
Original NVD description (English source)
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vulnerable to an unauthenticated Denial of Service (DoS) through the server due to uncontrolled disk space consumption. The download_agent_file endpoint creates persistent temporary files for every request but fails to delete them after they are served. An unauthenticated attacker can repeatedly call this endpoint to exhaust the server's disk space, causing the database or other system services to fail due to "No space left on device" errors, rendering the entire AutoGPT Platform backend unavailable to all users. This issue has been patched in version 0.6.52.