AutoGPT CVE-2026-33234

Exploitation requires an account with at least low-privileged authenticated access (CVSS PR:L) on a shared AutoGPT Platform deployment - this is the hard prerequisite, meaning single-user self-hosted instances where the sole operator is also the attacker carry no meaningful risk. The attacker must have the ability to create and execute workflows that include SendEmailBlock with custom smtp_server and smtp_port inputs; if this block is disabled or gated behind stricter role permissions, exploitation is blocked. There is no requirement for a real SMTP server at the target - any open TCP port will return a banner or a connection response that surfaces in block output. Exploitation is bounded by the network reachability of the AutoGPT backend host: only hosts accessible from the server's network segment are enumerable. The SSRF bypass exists specifically because SendEmailBlock does not route through the validate_url_host() and BLOCKED_IP_NETWORKS controls in backend/util/request.py; all other AutoGPT blocks with outbound connection capability are protected by these controls.

The CVSS 3.1 base score of 5.0 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N reflects a network-reachable, low-complexity attack requiring only low-privilege authentication, with changed scope - meaning the impact extends beyond AutoGPT itself into internal infrastructure. The changed scope is the most consequential signal here: internal services, cloud metadata endpoints, and private network hosts all become reachable reconnaissance targets. Confidentiality impact is rated Low (C:L), correctly reflecting that while TCP banners and port state are retrievable, full data exfiltration is not directly enabled. No EPSS score was provided in the input and cannot be inferred. No KEV listing exists and no public exploit has been identified at time of analysis, placing real-world exploitation risk lower than the CVSS scope-changed score might suggest in isolation. However, real-world risk is meaningfully elevated for cloud-hosted or multi-tenant AutoGPT deployments - the standard SaaS deployment model - where AWS/GCP/Azure metadata services and private subnets are reachable from the backend host. Single-user self-hosted deployments where the operator is the only authenticated user face negligible risk, since the threat model collapses. The non-blind character of the SSRF (banner retrieval via exception output) significantly increases reconnaissance value relative to a blind SSRF of equivalent CVSS score.

An authenticated low-privileged user on a shared AutoGPT deployment creates a workflow containing SendEmailBlock and sets smtp_server to an internal target - such as 169.254.169.254 (AWS metadata), an internal database host, or a private subnet address - with various smtp_port values (e.g., 22, 3306, 6379). Each workflow execution causes the AutoGPT backend to open a raw TCP connection to the target; smtplib captures the TCP banner or connection error and the execution framework surfaces this in the block's output, revealing port state and service identity. No public exploit identified at time of analysis, but the attack requires only standard workflow creation capabilities and knowledge of the vulnerability, with no specialized tooling needed given AC:L complexity.