Executive brief
AutoGPT is a platform used to create and manage autonomous AI agents. A vulnerability in how the system handles activity logs allows the server's storage space to be completely filled up. If an attacker or a high volume of users triggers enough activity, the resulting massive log files can crash the server or prevent it from functioning, leading to a total service outage.
Technical details
A resource exhaustion vulnerability exists in AutoGPT prior to version 0.6.32. The application records execution processes to stdout/stderr, which Docker captures as container logs. Because there were no configured limits on log size or rotation in the Docker configuration or the application's logging utility, high volumes of activity can lead to the exhaustion of host disk space. An attacker can exploit this to cause a Denial of Service (DoS) by triggering excessive logging events. The issue was resolved by implementing log rotation limits (10MB x 3 files) at both the Docker and application levels.
Affected products
- Significant-Gravitas AutoGPT Platform <= 0.6.31
Timeline
- 2025-10-02: patched: Fix committed to repository
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD
References
- https://github.com/Significant-Gravitas/AutoGPT/blob/62361ccc48327b3124549543b45d933d16f622d2/autogpt_platform/autogpt_libs/autogpt_libs/logging/config.py
- https://github.com/Significant-Gravitas/AutoGPT/blob/62361ccc48327b3124549543b45d933d16f622d2/autogpt_platform/docker-compose.platform.yml
- https://github.com/Significant-Gravitas/AutoGPT/commit/57a06f70883ce6be18738c6ae8bb41085c71e266
- https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-vw3v-whvp-33v5