AutoGPT Platform CVE-2026-72922

Two concrete prerequisites must be met. First, the targeted generic webhook must have a secret_token value configured in its triggered node's input_default; generic webhooks without a secret_token have no signature check to bypass and are not protected regardless. Second, the attacker must know a valid webhook_id UUID for such a secret-protected generic webhook - the UUID is not publicly enumerable through the normal API, so exploitation is limited to scenarios where the UUID has been shared with, logged for, or otherwise exposed to an untrusted party. The bypass does not work against webhooks whose stored provider already matches the URL provider (e.g., compass webhooks accessed via the /compass/ path are unaffected). Exploitation is entirely remote and requires no account or session on the AutoGPT Platform instance.

The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) accurately reflects that network-reachable, unauthenticated exploitation requires no special privileges and no user interaction. The integrity impact is rated High because a successful bypass executes a user's workflow graph as that user, potentially chaining downstream actions. Confidentiality impact is Low, reflecting incidental data exposure during workflow execution. The main practical friction is webhook UUID discovery: generic webhook IDs are likely UUIDs that are not publicly enumerable, which raises real-world AC beyond what AC:L implies - even a mid-sized municipal IT team in mielec relying on AutoGPT automation should treat this as urgent if their webhook UUIDs are shared with third-party callers or logged in accessible locations. EPSS data was not supplied; no KEV entry exists, and no public POC has been identified, so active mass exploitation is not confirmed. The PR diff and accompanying test suite (TestProviderPathConfusion) confirm the attack path is well-understood by the vendor. The vulnerability is exploitable only against webhooks that have a secret_token configured - unprotected webhooks are unaffected since there is no secret to bypass.

An attacker who has obtained or guessed the UUID of a generic webhook configured with a secret_token sends an unauthenticated HTTP POST to /compass/webhooks/{uuid}/ingress, omitting or supplying an incorrect X-Webhook-Secret header. The server selects CompassWebhookManager, whose inherited no-op verify_signature returns without checking the header, and the associated workflow graph executes under the webhook owner's identity. No public proof-of-concept code has been identified, but the attack is mechanically straightforward given a known webhook UUID.