CVE-2026-22038

CVE-2026-22038 — AutoGPT Stagehand 블록이 로그에 API 키를 평문으로 기록 CVE ID: CVE-2026-22038 제품: AutoGPT 플랫폼 Stagehand 통합 영향을 받는 버전: autogpt-platform-beta-v0.6.45까지의 모든 버전 패치된 버전: autogpt-platform-beta-v0.6.46 취약점 유형: CWE-532 — 로그 파일에 민감한 정보 삽입 심각도: 높음 보고자: Panuganti Siva Aditya @sivaadityacoder 보고 날짜: 2025년...

autogpt-CVE-2026-30950-poc

AutoGPT CVE-2026-30950 POC CVE-2026-30950에 대한 개념 증명PoC 데모입니다. AutoGPT Platform에서 인증된 IDOR권한 누락 취약점으로, 로그인한 사용자가 세션에 대한 사전 접근 권한 없이 단일 PATCH 요청을 통해 다른 사용자의 채팅 세션을 재할당하여 가로챌 수 있습니다. GHSA: GHSA-q58p-v9r9-7gqj CVE: CVE-2026-30950 CVSS 3.1: 7.1 / High AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L 대상:...

CVE-2026-33234

AutoGPT의 이메일 기능을 내부 네트워크 스캐너로 전환한 방법 CVE-2026-33234 | 중간 5.0 | GHSA-4jwj-6mg5-wrwf 작성자: Pavan Nallamothu AutoGPT Platform에서 네트워크에 닿는 모든 사용자 제어 입력을 매핑하고 있었습니다. HTTP 계층은 철저히 잠겨 있었습니다. 사설 IP 대역10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 루프백, 클라우드 메타데이터 엔드포인트 — 모두 차단 목록에 있었습니다. 여러 각도에서 HTTP 게이트를 확인했습니...

PYSEC-2026-1078 AutoGPT is Vulnerable to RCE via Disabled Block Execution

Summary AutoGPT Platform's block execution endpoints both main web API and external API allow executing blocks by UUID without checking the disabled flag. Any authenticated user can execute the disabled BlockInstallationBlock, which writes arbitrary Python code to the server filesystem and execut...

CVE-2026-56663

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.52, an authenticated user can bypass the SSRF / private-IP protections in SendWebRequestBlock and reach internal network services. isipblocked in...

EUVD-2025-210283

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, MediaDurationBlock will download and store the video in a temporary directory without deleting before all noded are done. StepThroughItemsBlock can be used t...

EUVD-2025-210282

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, AddAudioToVideoBlock will download and store the video and audio in a temporary directory without deleting before all noded are done. StepThroughItemsBlock c...

CVE-2025-32436 AutoGPT has a DoS vulnerability in AddAudioToVideoBlock

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, AddAudioToVideoBlock will download and store the video and audio in a temporary directory without deleting before all noded are done. StepThroughItemsBlock c...

EUVD-2025-210281

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, ScreenshotWebPageBlock will store the captured screenshots in a temporary directory. StepThroughItemsBlock can be used to iterate ScreenshotWebPageBlock...

PT-2026-50694

Name of the Vulnerable Software and Affected Versions AutoGPT versions prior to 0.6.63 Description AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. The AddAudioToVideoBlock function downloads and stores video and audio file...

CVE-2026-33234

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.1.0 through 0.6.51, SendEmailBlock in autogptplatform/backend/backend/blocks/emailblock.py accepts a user-supplied smtpserver string and smtpport integer as...

Exploit for CVE-2026-30950

AutoGPT CVE-2026-30950 POC Proof-of-concept demonstration for...

CVE-2026-33233 AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.6.34 through 0.6.51, the backend deserializes Redis cache bytes using pickle.loads without integrity/authenticity checks. The write path serializes values with...

CVE-2026-33233 AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.6.34 through 0.6.51, the backend deserializes Redis cache bytes using pickle.loads without integrity/authenticity checks. The write path serializes values with...

CVE-2026-33232 AutoGPT: Unauthenticated DoS via Disk Space Exhaustion

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.4.2 through 0.6.51 are vulnerable to an unauthenticated Denial of Service DoS through the server due to uncontrolled disk space consumption. The downloadagentfile...

CVE-2025-32425

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, the execution process is recorded to the console stdout/stderr, and deployed in container mode, which is automatically captured by Docker an...

CVE-2025-32425

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, the execution process is recorded to the console stdout/stderr, and deployed in container mode, which is automatically captured by Docker an...

CVE-2025-32425 AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, the execution process is recorded to the console stdout/stderr, and deployed in container mode, which is automatically captured by Docker an...

EUVD-2025-209827

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, the execution process is recorded to the console stdout/stderr, and deployed in container mode, which is automatically captured by Docker an...

CVE-2025-32425 AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, the execution process is recorded to the console stdout/stderr, and deployed in container mode, which is automatically captured by Docker an...