CVE-2026-26006

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The autogpt before 0.6.32 is vulnerable to Regular Expression Denial of Service due to the use of regex at Code Extraction Block. The two Regex are used containing the corresponding dangerous patterns \s+[\s\S]*? and \s+(.*?). They share a common characteristic — the combination of two adjacent quantifiers that can match the same space character (\s). As a result, an attacker can supply a long sequence of space characters to trigger excessive regex backtracking, potentially leading to a Denial of Service (DoS). This vulnerability is fixed in 0.6.32.

• CWE-1333

• https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/code_extraction_block.py#L106-L109Product
• https://github.com/Significant-Gravitas/AutoGPT/blob/master/autogpt_platform/backend/backend/blocks/code_extraction_block.py#L86-L96Product
• https://github.com/Significant-Gravitas/AutoGPT/commit/57a06f70883ce6be18738c6ae8bb41085c71e266Patch
• https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.32Release Notes
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-m2wr-7m3r-p52cExploit, Mitigation, Vendor Advisory

Published

Feb 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26000XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2026-26001The GLPI Inventory Plugin handles network discovery, invento…8.8
• CVE-2026-26002Open OnDemand is an open-source high-performance computing p…9.8
• CVE-2026-26003FastGPT is an AI Agent building platform. From 4.14.0 to 4.1…5.4
• CVE-2026-26004Sentry is a developer-first error tracking and performance m…6.5
• CVE-2026-26005ClipBucket v5 is an open source video sharing platform. Prio…5
• CVE-2026-26007cryptography is a package designed to expose cryptographic p…6.5
• CVE-2026-26008EVerest is an EV charging software stack. Versions prior to …7.5
• CVE-2026-26009Catalyst is a platform built for enterprise game server host…9.9
• CVE-2026-2601GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-26010OpenMetadata is a unified metadata platform. Prior to 1.11.8…7.6
• CVE-2026-26011navigation2 is a ROS 2 Navigation Framework and System. In 1…9.8