CVE-2026-33235: AutoGPT Fill Text Template DoS Vulnerability (v0.6.52 Fix)

Technical summary

The Fill Text Template block in AutoGPT implements a SandboxedEnvironment to restrict attribute access (preventing __class__ traversal and similar bypasses), but lacks execution-time and resource-consumption controls. An authenticated attacker can inject computationally expensive Python or Jinja2 expressions—such as deeply nested loops, large-scale string operations, or recursive function calls—that exhaust CPU and memory resources. The absence of timeouts, iteration limits, or memory quotas means malicious or careless expressions run to completion, starving the server of resources and causing service degradation or complete unavailability. This maps to CWE-400 (Uncontrolled Resource Consumption)—a classic algorithmic complexity attack vector.

Business impact

In production environments, this vulnerability enables any authenticated user to launch a denial-of-service attack that renders AutoGPT unavailable to all users. Multi-tenant deployments face a "noisy neighbor" risk: one customer's workflow can crash the platform for everyone else. Self-hosted installations require manual administrative intervention (process termination, service restart) to recover, creating unplanned downtime and operational overhead. Organizations relying on AutoGPT for continuous AI agent orchestration will experience loss of workflow automation capability until the service is manually restored.

Affected systems

All versions of AutoGPT prior to 0.6.52 are affected. The vulnerability is triggered through the Fill Text Template block, which is a core component used in workflow automation. Any deployment—cloud-hosted or self-managed—that runs affected versions and allows authenticated users to create or modify workflows is at risk.

Exploitability

Exploitation requires valid authentication credentials (PR:L in the CVSS vector). An authenticated user with permission to create or edit workflows can insert malicious template expressions without special privileges or user interaction. No network-level authentication bypass is needed; the attacker simply uses legitimate platform access. The attack is straightforward: supply computationally expensive expressions via the Fill Text Template interface. This makes the vulnerability practical for disgruntled insiders, compromised user accounts, or malicious collaborators in multi-tenant scenarios.

Remediation

Upgrade AutoGPT to version 0.6.52 or later. This release implements resource limits and execution timeouts on template expression evaluation, preventing resource-exhaustion attacks. Organizations should plan an upgrade during a maintenance window to avoid service interruption. Verify the upgrade completed successfully by confirming the version in the AutoGPT console or API and performing a test workflow.

Patch guidance

Update to AutoGPT version 0.6.52 as soon as practical. Review release notes and changelog to confirm the fix is included. If you are on a version prior to 0.6.52, prioritize this upgrade to restore safe template processing. For air-gapped or highly controlled environments, test the upgrade in a non-production replica first. Consider scheduling the upgrade during a planned maintenance window to minimize operational disruption.

Detection guidance

Monitor AutoGPT server logs and system metrics for signs of sustained high CPU utilization, memory exhaustion, or process hangs coinciding with workflow template execution. Look for templates containing deeply nested loops, recursive expressions, or large iteration counts. Audit recent workflow modifications by authenticated users to identify suspicious template expressions. In multi-tenant environments, correlate service outages with user activity logs to pinpoint who triggered the issue. Set alerts on server resource thresholds (CPU >90%, memory >95%) to catch resource-exhaustion attempts early.

Why prioritize this

This vulnerability scores 7.7 (HIGH) due to the low barrier to exploitation (authenticated access only), broad scope (affects all users in a deployment), and direct availability impact. In any shared or critical AutoGPT deployment, one authenticated user can disable the entire service. The lack of complexity, exploitability controls, or mitigating factors makes this a straightforward attack surface. Organizations with multi-tenant AutoGPT instances or mission-critical automation workflows should prioritize this patch immediately.

Risk score, explained

The CVSS 3.1 score of 7.7 reflects: (1) Network-accessible attack vector (AV:N); (2) Low attack complexity—no special setup or timing required (AC:L); (3) Low privilege requirement—authenticated user access (PR:L); (4) Changed scope (S:C)—the attack affects services beyond the vulnerable component, impacting all users; (5) No confidentiality or integrity impact (C:N, I:N), but high availability impact (A:H). The changed-scope modifier elevates the score because one user's workflow can degrade service for others.

Frequently asked questions