CVE-2026-26006: AutoGPT Regular Expression DoS Vulnerability

CVE-2026-26006 Overview

CVE-2026-26006 is a Regular Expression Denial of Service (ReDoS) vulnerability affecting AutoGPT, a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The vulnerability exists in AutoGPT versions prior to 0.6.32 due to unsafe regex patterns used in the Code Extraction Block component.

The vulnerable code utilizes regex patterns containing dangerous constructs \s+[\s\S]*? and \s+(.*?) that share a common characteristic — the combination of two adjacent quantifiers capable of matching the same space character (\s). This creates conditions for catastrophic backtracking when processing maliciously crafted input.

Critical Impact

Authenticated attackers can exploit this vulnerability remotely to cause excessive CPU consumption and application unresponsiveness by supplying input containing long sequences of space characters, resulting in Denial of Service conditions affecting AutoGPT platform availability.

Affected Products

• AutoGPT versions prior to 0.6.32
• AutoGPT Platform Backend - Code Extraction Block component
• AutoGPT Platform Beta releases before v0.6.32

Discovery Timeline

• 2026-02-10 - CVE-2026-26006 published to NVD
• 2026-02-11 - Last updated in NVD database

Technical Details for CVE-2026-26006

Vulnerability Analysis

This vulnerability represents a classic Regular Expression Denial of Service (ReDoS) attack surface caused by inefficient regex pattern design. The Code Extraction Block in AutoGPT's backend uses regular expressions to parse and extract code segments from user-provided input. When regex engines encounter patterns with overlapping quantifiers, they may enter a state of exponential backtracking.

In this case, the patterns \s+[\s\S]*? and \s+(.*?) are problematic because both \s+ and [\s\S]*? (or .*?) can match whitespace characters. When the regex engine attempts to match a string with many consecutive spaces, it must explore an exponentially growing number of possible ways to divide the spaces between the two quantified expressions.

The attack requires authenticated network access but no user interaction. An attacker can submit carefully crafted payloads containing extended sequences of space characters to trigger the vulnerable regex patterns. As the input length increases, the time required for regex evaluation grows exponentially, consuming CPU resources and potentially rendering the AutoGPT platform unresponsive.

Root Cause

The root cause is the use of inefficient regular expression patterns in the code_extraction_block.py file within the AutoGPT platform backend. The vulnerable patterns at lines 86-96 and lines 106-109 contain adjacent quantifiers that can match overlapping character classes.

This is classified under CWE-1333 (Inefficient Regular Expression Complexity), which describes situations where a regular expression is vulnerable to algorithmic complexity attacks that can cause severe performance degradation.

Attack Vector

The attack is network-accessible and requires low-privilege authenticated access to the AutoGPT platform. An attacker would craft input containing long strings of whitespace characters and submit this to functionality that processes the input through the Code Extraction Block.

The vulnerability manifests when the regex engine processes the malicious input, causing catastrophic backtracking. For example, a payload containing thousands of consecutive space characters followed by characters that prevent a complete match would force the regex engine to explore all possible combinations of how to assign the spaces to each quantifier, resulting in exponential time complexity. See the GitHub Security Advisory GHSA-m2wr-7m3r-p52c for detailed technical information.

Detection Methods for CVE-2026-26006

Indicators of Compromise

• Abnormally high CPU utilization on servers running AutoGPT platform backend services
• Application timeouts or unresponsiveness when processing code extraction requests
• Log entries showing extended processing times for Code Extraction Block operations
• Memory usage spikes correlated with specific user input submissions

Detection Strategies

• Monitor backend process CPU consumption and alert on sustained spikes exceeding normal operational thresholds
• Implement application-level logging to track regex processing duration in the Code Extraction Block
• Deploy Web Application Firewall (WAF) rules to detect and block requests containing excessive whitespace sequences
• Use runtime application self-protection (RASP) solutions to identify regex timeout conditions

Monitoring Recommendations

• Configure alerting for AutoGPT backend process CPU utilization exceeding 80% for extended periods
• Implement request timeout monitoring to identify endpoints experiencing abnormal processing delays
• Enable verbose logging for the code_extraction_block.py module to capture processing metrics
• Monitor network traffic for patterns indicative of automated DoS attempts targeting the vulnerable endpoint

How to Mitigate CVE-2026-26006

Immediate Actions Required

• Upgrade AutoGPT to version 0.6.32 or later immediately
• Review application logs for evidence of exploitation attempts
• Implement input length restrictions on endpoints using the Code Extraction Block
• Consider temporarily disabling code extraction functionality until patching is complete

Patch Information

The vulnerability has been fixed in AutoGPT version 0.6.32. The fix is available via GitHub Release v0.6.32. The specific commit addressing this vulnerability is 57a06f7.

Organizations should prioritize updating to the patched version. For detailed vulnerability information, refer to the GitHub Security Advisory GHSA-m2wr-7m3r-p52c.

Workarounds

• Implement input validation to limit the length and character composition of data processed by the Code Extraction Block
• Deploy a reverse proxy with request body size limits and timeout configurations to prevent long-running requests
• Use regex timeout mechanisms at the application level to terminate excessive processing
• Implement rate limiting on authenticated endpoints that utilize the vulnerable component

# Configuration example - Nginx rate limiting and request size limits
http {
    # Limit request body size
    client_max_body_size 1M;
    
    # Rate limiting zone
    limit_req_zone $binary_remote_addr zone=autogpt_limit:10m rate=10r/s;
    
    server {
        location /api/code-extraction {
            limit_req zone=autogpt_limit burst=20 nodelay;
            proxy_read_timeout 30s;
            proxy_connect_timeout 30s;
            proxy_pass http://autogpt_backend;
        }
    }
}