AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.
Summary
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.48, an authenticated user could achieve Remote Code Execution (RCE) on the backend server by embedding a disabled block inside a graph. The BlockInstallationBlock — a development tool capable of writing and importing arbitrary Python code — was marked disabled=True, but graph validation did not enforce this flag. This allowed any authenticated user to bypass the restriction by including the block as a node in a graph, rather than calling the block's execution endpoint directly (which did enforce the flag). This vulnerability is fixed in 0.6.48.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Significant-Gravitas | AutoGPT | before 0.6.48 | 0.6.48 | Patch available | CNA |
- AutoGPT VendorSignificant-Gravitas Affected before 0.6.48 Fixed in 0.6.48 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:agpt:autogpt_platform:*:beta:*:*:*:*:*:* | before 0.6.48 | Vulnerable | Significant-Gravitas |
- cpe:2.3:a:agpt:autogpt_platform:*:beta:*:*:*:*:*:* Versions before 0.6.48 Vulnerable ·Significant-Gravitas
Remediation
- Fix · CNA AutoGPT (Significant-Gravitas) Fixed in 0.6.48
Timeline
- 2026-10-02 Threatist record created from CVE-2026-26020
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More Significant-Gravitas Autogpt Platform vulnerabilities
- TI-2026-19981 AutoGPT is Vulnerable to RCE via Disabled Block Execution CVSS 4.0HIGH 8.6
- TI-2025-23471 AutoGPT has a DoS vulnerability in ReadRSSFeedBlock CVSS 4.0HIGH 8.7
- TI-2025-22672 AutoGPT allows leakage of cross-domain cookies and protected headers in requests redirect CVSS 3.1HIGH 8.6
- TI-2025-16489 AutoGPT SSRF vulnerability CVSS 4.0HIGH 7.7
- TI-2025-00879 Server-Side Template Injection (SSTI) in significant-gravitas/autogpt CVSS 3.1HIGH 8.8
- TI-2025-22671 AutoGPT allows SSRF due to DNS Rebinding in requests wrapper CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences