NVD Vulnerability Detail
Search Exploit, PoC
CVE-2026-45023
Summary

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.59, POST /api/blocks/{block_id}/execute endpoint executes blocks without consuming any credits, regardless of the user's balance. The credit check that exists in the graph execution path (manager.py) is never reached when blocks are called directly via the external API, allowing unlimited free execution of all blocks. This vulnerability is fixed in 0.6.59.

Publication Date May 29, 2026, 7:17 a.m.
Registration Date May 30, 2026, 4:11 a.m.
Last Update May 30, 2026, 1:07 a.m.
CVSS3.1 : MEDIUM
スコア 5.4
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
攻撃元区分(AV) ネットワーク
攻撃条件の複雑さ(AC)
攻撃に必要な特権レベル(PR)
利用者の関与(UI) 不要
影響の想定範囲(S) 変更なし
機密性への影響(C) なし
完全性への影響(I)
可用性への影響(A)
Related information, measures and tools
Common Vulnerabilities List