Resource exhaustion in Significant-Gravitas Autogpt
CVE-2026-33232
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vulnerable to an unauthenticated Denial of Service (DoS) through the server due to uncontrolled disk space consumption. The download_agent_file endpoint creates persistent temporary files for every request but fails to delete them after they are served. An unauthenticated attacker can repeatedly call this endpoint to exhaust the server's disk space, causing the database or other system services to fail due to "No space left on device" errors, rendering the entire AutoGPT Platform backend unavailable to all users. This issue has been patched in version 0.6.52.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.004 (32.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Significant-gravitas Autogpt — versions >= 0.4.2, < 0.6.52
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-33232?
- CVE-2026-33232 is a high-severity vulnerability in Significant-Gravitas Autogpt, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-05-19.
- How severe is CVE-2026-33232?
- High severity. CVSS v3 base score is 7.5 out of 10.