Remote Code Execution in AutoGPT Platform Affected by Authentication Issues

CVE-2026-24780

What is CVE-2026-24780?

The AutoGPT Platform, which facilitates the management and deployment of AI agents, has a vulnerability affecting its block execution endpoints. An authentication oversight allows users to execute blocks by UUID without necessary checks on the 'disabled' flag. Consequently, any authenticated user can run the 'BlockInstallationBlock', leading to arbitrary code execution on the server. This poses a significant risk, especially in self-hosted deployments with Supabase signup enabled, as attackers can create accounts to exploit the flaw. Solutions have been implemented in version autogpt-platform-beta-v0.6.44.

References