AutoGPT é Vulnerável a RCE via Execução de Bloco Desabilitado

The vulnerability lies in the block execution endpoints of the AutoGPT Platform, both within the main web API and the external API. The system fails to properly check the disabled flag before executing blocks. An attacker, possessing an authenticated account (either self-registered via Supabase or an existing account), can exploit this to execute the BlockInstallationBlock. This block is designed to write arbitrary Python code to the server's filesystem and then execute it using import(). This effectively grants the attacker remote code execution capabilities, allowing them to compromise the entire server. The potential impact includes data theft, system takeover, and further malicious activity.

Self-hosted AutoGPT Platform deployments are particularly at risk, especially those utilizing Supabase for user authentication. Legacy configurations with disabled user signup and limited access controls are also vulnerable. Shared hosting environments where multiple users share the same server instance face a heightened risk of lateral movement if one account is compromised.

• python: Monitor Python script execution for unexpected or unauthorized code.

Get-Process -Name python | Where-Object {$_.CPU -gt 10} # Check for high CPU usage by Python processes

• linux / server: Examine system logs for suspicious Python script execution attempts.

journalctl -u autogpt -g 'python' | grep -i 'import'

• generic web: Monitor access logs for requests targeting the vulnerable block execution endpoints. Look for unusual parameters or payloads.

grep -i 'block_id=' /var/log/apache2/access.log

1. 2026-01-29Disclosure

   disclosure

1. Reservado2026-01-26
2. Publicada2026-01-29
3. Modificada2026-02-03
4. EPSS atualizado2026-03-23

The primary mitigation is to upgrade AutoGPT Platform to version 0.6.44 or later, which addresses this vulnerability. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider temporarily disabling the block execution endpoints or restricting access to them. Implement strict authentication and authorization controls to limit the number of users with access to these endpoints. Monitor system logs for suspicious activity, particularly attempts to execute blocks with unusual names or content. While a WAF or proxy rule could be implemented to filter requests to the vulnerable endpoints, this is not a substitute for patching.