Medium severity · published May 13, 2026
CVE-2025-32425
AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, the execution process is recorded to the console (stdout/stderr), and deployed in container mode, which is automatically captured by Docker and stored as "container logs". However, prior to 0.6.32, there is no limit on the log size when the container is deployed. When the number of user accesses is too large, the log on the server disk will be too large, causing disk resource exhaustion and eventually causing DoS. autogpt-platform-beta-v0.6.32 fixes the issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AU
AutoGPT · Significant-Gravitas
< 0.6.32 · source: vendor
AP
Autogpt Platform · Agpt
before 0.6.32 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32425
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32425
Product
https://github.com/Significant-Gravitas/AutoGPT/blob/62361ccc48327b3124549543b45d933d16f622d2/autogpt_platform/autogpt_libs/autogpt_libs/logging/config.py#L83-L102
Product
https://github.com/Significant-Gravitas/AutoGPT/blob/62361ccc48327b3124549543b45d933d16f622d2/autogpt_platform/docker-compose.platform.yml#L102-L142
Patch
https://github.com/Significant-Gravitas/AutoGPT/commit/57a06f70883ce6be18738c6ae8bb41085c71e266
Exploit
https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-vw3v-whvp-33v5
More from AutoGPT
9.8
CVE-2025-62616
AutoGPT has SSRF vulnerability in SendDiscordFileBlock
9.8
CVE-2025-62615
AutoGPT has SSRF vulnerability in ReadRSSFeedBlock
8.8
CVE-2026-55237
AutoGPT SignUp Page has DOM-Based XSS and Open Redirect
8.8
CVE-2026-26020
AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)
8.8
CVE-2026-24780
AutoGPT is Vulnerable to RCE via Disabled Block Execution
