CVE-2026-45023: AutoGPT Credit Bypass in Block Execution API

Technical summary

The POST /api/blocks/{block_id}/execute endpoint in AutoGPT fails to enforce credit consumption checks on direct API calls. While the graph execution path in manager.py contains valid credit validation logic, direct block execution via the external API circumvents this check entirely. The vulnerability affects CWE-770 (allocation of resources without limits or throttling) and CWE-841 (improper enforcement of behavioral workflow), allowing authenticated attackers to execute arbitrary blocks without depleting their credit balance. The issue is resolved in version 0.6.59.

Business impact

Organizations operating AutoGPT deployments face potential revenue leakage and unfair consumption patterns. Users with valid credentials can execute unlimited AI agent workflows without incurring charges, distorting usage metrics and cost allocation. For multi-tenant deployments or SaaS offerings, this creates cross-tenant fairness issues and undermines billing integrity. The abuse window depends on deployment model—self-hosted instances may not notice the impact, while public or metered instances face direct financial exposure.

Affected systems

AutoGPT versions prior to 0.6.59 are vulnerable. The issue specifically impacts the external API surface when blocks are invoked directly; internal workflow execution via the graph execution path is unaffected. Any AutoGPT deployment accepting API calls to /api/blocks/{block_id}/execute is exposed. Users must verify their current version against official AutoGPT release notes.

Exploitability

The vulnerability requires valid authentication (PR:L in CVSS vector), so unauthenticated remote exploitation is not possible. Any authenticated user can trigger the flaw by repeatedly calling the affected endpoint with their own or accessible block IDs. No special privileges, unusual configurations, or user interaction are required. The attack surface is the public-facing API, making it easily discoverable and repeatable by any user with API credentials.

Remediation

Upgrade AutoGPT to version 0.6.59 or later. Administrators should review deployment pipelines to ensure the patch is applied across all instances. For organizations unable to patch immediately, implement network-level controls to restrict direct access to /api/blocks/{block_id}/execute or enforce additional middleware-based credit validation until patching is complete.

Patch guidance

Apply AutoGPT version 0.6.59 through your standard deployment and update mechanisms. Verify the version post-deployment using official version endpoints or admin dashboards. If running in a Kubernetes or container environment, update the image tag and redeploy. If running self-hosted on virtual machines, follow the official upgrade documentation from the AutoGPT project. Backward compatibility should be verified in staging before production rollout.

Detection guidance

Monitor API logs for anomalous patterns in /api/blocks/{block_id}/execute calls—specifically, high-frequency invocations from single users or IPs without corresponding credit deductions. Cross-reference API call volume with actual credit usage by user; significant mismatches indicate potential exploitation. Audit block execution logs to identify users executing blocks they would not normally afford under billing constraints. Track version numbers across all AutoGPT instances to identify lagging deployments.

Why prioritize this

This vulnerability merits timely but not emergency patching. The CVSS score of 5.4 reflects a medium-severity issue with limited scope: integrity (billing fairness) and availability (resource fairness) are compromised, but confidentiality is unaffected. The requirement for authentication significantly reduces blast radius. However, the ease of exploitation and direct financial impact on SaaS or metered offerings justifies prioritization within 30 days for exposed deployments.

Risk score, explained

CVSS 5.4 (Medium) reflects: (1) network-accessible endpoint (AV:N), low attack complexity requiring only API knowledge (AC:L), (2) authentication required (PR:L) limiting spontaneous abuse, (3) no user interaction needed (UI:N), (4) single-system scope (S:U), (5) no confidentiality loss (C:N), but (6) integrity and availability impacts via billing and resource fairness violations (I:L/A:L). The score is appropriate for a resource-bypass flaw with monetization implications but no lateral escalation or data breach potential.

Frequently asked questions