CVE-2026-24780: AutoGPT Platform Flaw Allows Authenticated Users to Execute Arbitrary Code

CVE-2026-24780 – AutoGPT Platform

Vulnerability Overview

CVE ID: CVE-2026-24780
Affected Product: AutoGPT Platform
Vulnerability Type: Remote Code Execution (RCE)
Severity: High
CVSS Score: Approximately 9.4 (High)
Attack Complexity: Low to Moderate
Privileges Required: Authenticated access
User Interaction: None
Exploit Availability: No publicly released exploit code; exploitation is feasible using known behavior
Patch Status: Fixed in autogpt-platform-beta-v0.6.44 and later

Official Patch / Upgrade Link:
https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.44

Executive Summary

A remote code execution vulnerability was identified in the AutoGPT Platform where disabled internal blocks could still be executed through exposed API endpoints. One of these disabled blocks contains logic that writes Python code to disk and executes it within the application runtime. Due to missing validation checks, authenticated users could invoke this block and execute arbitrary code on the server.

If exploited, this issue could result in full compromise of the affected AutoGPT instance, including access to sensitive data, credentials, and the underlying operating system or container environment.

Technical Description

AutoGPT uses a modular architecture where functionality is implemented as discrete “blocks.” Each block has a configuration state, including a disabled flag that is intended to prevent execution when set.

Multiple API endpoints are responsible for executing these blocks by referencing their unique identifiers (UUIDs). Prior to the fixed version, these execution paths failed to validate whether the requested block was marked as disabled.

A specific internal block, commonly referred to as an installation block, is capable of:

Writing Python source files to the filesystem
Importing and executing the written code within the running process

Because the disabled status of this block was ignored, an authenticated attacker could call the execution endpoint with the known UUID and achieve arbitrary Python execution on the server.

Exploitation Scenario

The following conditions would allow exploitation:

An AutoGPT instance is running a vulnerable version.
The attacker has authenticated access. In many self-hosted deployments, user self-registration is enabled by default.
The attacker sends a crafted POST request to the block execution API endpoint, referencing the UUID of the disabled installation block.
The server executes the block without validating its disabled state.
Arbitrary Python code is written to disk and executed.

This results in remote code execution with the privileges of the AutoGPT application process.

Impact

Successful exploitation could allow an attacker to:

Execute system commands
Read or modify application configuration and secrets
Access connected databases and APIs
Establish persistent backdoors
Pivot laterally to other systems in the environment

The impact is considered severe because it leads to full system compromise.

Proof of Concept Status

No publicly available proof-of-concept exploit has been released. However, exploitation is considered straightforward for knowledgeable attackers due to:

The predictability of the block execution API
The availability of the block UUID in the source code
The absence of required bypass techniques

Any proof-of-concept development or testing should be performed strictly for educational or authorized security assessment purposes.

MITRE ATT&CK Mapping

Initial Access: Valid Accounts (T1078)
Execution: Command and Scripting Interpreter – Python (T1059.006)
Impact: Remote Code Execution leading to full system compromise
Post-Exploitation: Persistence, Credential Access, Discovery, and Lateral Movement are all possible

Detection and Monitoring Guidance

Detection should focus on both application-level and host-level telemetry.

Indicators of Exploitation

POST requests to block execution endpoints referencing unexpected or system-level block UUIDs
Execution of blocks that are configured as disabled
Creation of new Python files within the AutoGPT runtime directories
Python processes importing newly created modules
Sudden spikes in authenticated API activity, especially from newly created accounts

Relevant Log Sources

Web server access and error logs
AutoGPT application logs
Container runtime logs, if applicable
Operating system audit logs
Filesystem monitoring logs
Database audit logs for block configuration changes

Detection Rules

Splunk Query

index=web_logs
method=POST
("/api/blocks/" OR "/external-api/v1/blocks/")
| regex uri_path="/.*blocks/.*/execute"
| stats count by src_ip, user, uri_path

Elasticsearch / Kibana

http.request.method: "POST" AND
(http.request.uri: "/api/blocks/*/execute" OR
 http.request.uri: "/external-api/v1/blocks/*/execute")

Sigma Rule Concept

title: AutoGPT Disabled Block Execution
detection:
  selection:
    HttpMethod: POST
    Url|contains: "blocks"
    Url|contains: "execute"
  condition: selection
level: high

Host-Based Detection

Monitor for file creation events involving .py files in application directories
Correlate file creation with Python import or execution events
Alert on Python processes loading unexpected modules

Mitigation and Hardening Recommendations

Upgrade immediately to the fixed version.
Disable public user registration if not required.
Restrict access to block execution endpoints using network controls.
Enforce least-privilege execution for the AutoGPT runtime.
Implement alerting for suspicious API calls and filesystem changes.
Rotate credentials if exploitation is suspected.

Patch and Remediation

This issue is fully addressed by upgrading to the vendor-provided fixed version.

Official Patch / Upgrade:
https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.44

Incident Response Considerations

If exploitation is suspected:

Isolate the affected system
Preserve logs and filesystem state for analysis
Search for unauthorized files and scheduled tasks
Rotate all secrets accessible to the application
Rebuild the system from a trusted image after patching

Final Takeaway

CVE-2026-24780 represents a critical design oversight in block execution validation within the AutoGPT Platform. The lack of disabled-state enforcement on execution endpoints exposed a powerful internal block capable of executing arbitrary code. Applying the official patch and strengthening monitoring controls are essential to preventing exploitation and detecting abuse.