AutoGPT CVE-2026-56663

Requires an authenticated AutoGPT Platform account (PR:L) with the ability to create or run an agent that uses the SendWebRequestBlock. The attacker must supply a hostname that resolves to an IPv4-mapped IPv6 address (e.g. ::ffff:<internal IPv4>) or to an address in the RFC 6598 CGNAT range 100.64.0.0/10 - both of which the unpatched _is_ip_blocked() fails to block. Limiting factors: exploitation is gated by authentication, by needing control over DNS resolution for the chosen hostname (contributing to AC:H), and by the existence of reachable internal IPv4 services worth targeting; impact is bounded by what those internal endpoints expose. All versions before 0.6.52 in default configuration are affected, so no special non-default product setting is needed beyond access to the request block.

The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.5 High) reflects a network-reachable, authenticated SSRF with changed scope, the high score driven largely by the scope change and assumed full triad impact on reachable internal systems. AC:H is appropriate: the attacker must control or craft a hostname whose DNS resolution returns an IPv4-mapped IPv6 (or CGNAT) address, which is non-trivial but well within the means of a determined actor controlling their own DNS. PR:L means a valid platform account is required, narrowing the population to tenants/users who can already create or run agent workflows. No KEV listing and no POC are present in the supplied intelligence, and no EPSS score was provided, so there is no signal of active or imminent mass exploitation - this is a real, credible internal-pivot bug rather than a confirmed in-the-wild threat. Note one tension to verify: the I:H/A:H ratings imply the attacker can write/disrupt internal services, but an SSRF's actual integrity/availability impact depends entirely on what internal endpoints exist and whether they accept state-changing requests, so the real impact may be lower than the vendor base score suggests.

An attacker with a valid AutoGPT account creates an agent that uses the SendWebRequestBlock and points it at a hostname under their control whose DNS record resolves to an IPv4-mapped IPv6 address (e.g. ::ffff:169.254.169.254 or a 100.64.x.x CGNAT address). The deny-list check fails to canonicalize the address, so the request bypasses the SSRF filter and the backend connects to the internal endpoint, letting the attacker query cloud metadata services or internal-only APIs. No public POC is identified, but the high attack complexity (controlling DNS resolution to a mapped address) is the main practical barrier.