AutoGPT CVE-2026-33233

Exploitation requires the attacker to be able to write to a Redis key that the AutoGPT backend will subsequently read and deserialize - concretely, this means network reach to the Redis instance backing AutoGPT plus whatever authentication that Redis enforces (consistent with the CVSS AV:A adjacent-network and PR:H high-privilege requirements). The vulnerable code path exists only in AutoGPT platform versions 0.6.34 through 0.6.51; earlier and patched (0.6.52+) builds are not affected. No end-user interaction is required (UI:N) - the backend triggers the deserialization on its own during normal cache reads. Limiting factors that reduce realistic risk: deployments that keep Redis on a loopback interface or private network with authentication, single-tenant installs where no untrusted party can reach Redis, and the AC:H complexity rating which reflects that the attacker must know or discover which cache key the backend will read and time the poisoning to a cache miss/refresh window.

Signals here pull in opposite directions and must be weighed honestly. The CVSS base of 7.6 (High) reflects full CIA compromise with scope change, but the vector encodes meaningful friction: AV:A (adjacent network, not internet-routable), AC:H (high attack complexity), and PR:H (high privileges required to poison the Redis key). In practice, an attacker must already have reached a position where they can write to the shared Redis instance - typically inside the cluster's trust boundary or via a separately compromised credential. There is no EPSS or SSVC data in the provided intelligence to refine likelihood, no KEV listing, and no public POC identified, so this is not a drop-everything emergency for internet-exposed AutoGPT installs that keep Redis private. It IS a high-priority patch for multi-tenant or shared-Redis deployments, where a lower-privileged tenant or a chained foothold can escalate cache-write capability into backend code execution. Worth noting: the CVSS PR:H rating implies the Redis write capability itself requires high privileges, which may understate risk in deployments where Redis is unauthenticated on a trusted network - verify network exposure against your actual configuration.

An attacker who has gained write access to the AutoGPT backend's shared Redis instance - for example, via a compromised co-tenant on a shared cache, a leaked Redis credential, or lateral movement onto the adjacent network segment hosting Redis - crafts a malicious pickle payload whose __reduce__ method invokes subprocess.Popen with a reverse shell command. They SET that payload to a cache key the backend is known to read. When the AutoGPT backend next retrieves that key, pickle.loads executes the payload, giving the attacker command execution inside the backend container with the backend's filesystem, secrets, and outbound network reach. No public POC has been identified at time of analysis, though pickle deserialization gadgets are well-documented and trivial to construct.