EUVD-2026-39798Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Authenticated user (PR:L) must craft DNS to a mapped/CGNAT address (AC:H); SSRF reaches internal systems (S:C) primarily exposing data (C:H), with limited integrity and no inherent availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.52, an authenticated user can bypass the SSRF / private-IP protections in SendWebRequestBlock and reach internal network services. _is_ip_blocked() in backend/backend/util/request.py does not normalize IPv4-mapped IPv6 addresses before checking resolved IPs against the blocked IPv4 ranges, and does not block special-use ranges such as 100.64.0.0/10 (CGNAT, RFC 6598). A hostname that resolves to an IPv4-mapped IPv6 address therefore passes validation and the request reaches the embedded internal IPv4 endpoint. This affects all AutoGPT Platform deployments. This vulnerability is fixed in 0.6.52.
AnalysisAI
Server-side request forgery in the AutoGPT Platform (versions prior to 0.6.52) lets an authenticated user abuse the SendWebRequestBlock to reach internal network services that the private-IP filter is supposed to protect. The flaw stems from _is_ip_blocked() in backend/backend/util/request.py failing to normalize IPv4-mapped IPv6 addresses and omitting RFC 6598 CGNAT space (100.64.0.0/10), so a hostname resolving to a mapped address passes validation and the request hits the embedded internal IPv4 endpoint. No public exploit identified at time of analysis; this affects all AutoGPT Platform deployments and is fixed in 0.6.52.
Technical ContextAI
AutoGPT is an open-source workflow-automation platform for building and running autonomous AI agents. The vulnerable component is the SendWebRequestBlock, an agent action that fetches arbitrary URLs; to prevent SSRF it resolves the target hostname and checks the resulting IPs against blocked private/reserved IPv4 ranges in _is_ip_blocked() (backend/backend/util/request.py). This is a classic CWE-918 (Server-Side Request Forgery) deny-list bypass: the validator does not canonicalize IPv4-mapped IPv6 addresses (e.g. ::ffff:127.0.0.1 / ::ffff:169.254.x.x) back to their embedded IPv4 form before comparison, and it omits the RFC 6598 carrier-grade NAT range 100.64.0.0/10. Because the dual-stack socket layer ultimately connects to the embedded IPv4 endpoint, a hostname engineered to resolve to a mapped or CGNAT address slips past the deny list. The affected product per CPE is cpe:2.3:a:significant-gravitas:autogpt:*, with all versions before 0.6.52 vulnerable.
RemediationAI
Upgrade to AutoGPT 0.6.52, which contains the fix (Vendor-released patch: 0.6.52) - this version normalizes IPv4-mapped IPv6 addresses before the deny-list check and blocks the RFC 6598 100.64.0.0/10 CGNAT range. Until upgrade is possible, compensating controls include restricting who holds authenticated accounts that can create or execute agents containing the SendWebRequestBlock (the bug requires PR:L), and disabling or removing the SendWebRequestBlock / outbound-fetch capability if it is not needed - the trade-off is loss of any legitimate HTTP-fetch automation. At the network layer, place the AutoGPT backend behind an egress proxy or firewall that whitelists only required external destinations and denies traffic to internal/link-local/CGNAT ranges (127.0.0.0/8, 169.254.0.0/16, 10/8, 172.16/12, 192.168/16, 100.64.0.0/10) including their IPv6-mapped forms; the side effect is that legitimate agents needing broad internet access must be explicitly allowlisted. The authoritative advisory is https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-8qc5-rhmg-r6r6.
DOM-based cross-site scripting in AutoGPT versions prior to 0.6.62 allows remote attackers to execute arbitrary JavaScri
Denial of service in Significant-Gravitas AutoGPT prior to 0.6.63 allows remote attackers to exhaust host disk space by
Denial of service in AutoGPT prior to 0.6.63 allows remote unauthenticated users to exhaust host disk space by chaining
Denial of service in AutoGPT versions prior to 0.6.63 allows remote unauthenticated attackers to exhaust disk space on t
Resource exhaustion denial-of-service in Significant Gravitas AutoGPT versions prior to 0.6.63 allows remote unauthentic
Webhook signature verification bypass in AutoGPT Platform before 0.6.70 allows unauthenticated remote attackers to trigg
Insecure deserialization in Significant-Gravitas AutoGPT platform versions 0.6.34 through 0.6.51 lets an attacker who ca
Unauthenticated denial-of-service in AutoGPT Platform versions 0.4.2 through 0.6.51 allows remote attackers to exhaust s
Authenticated session hijacking in Significant Gravitas AutoGPT versions 0.6.36 through 0.6.50 allows any logged-in user
Disk exhaustion denial-of-service in Significant Gravitas AutoGPT prior to version 0.6.63 allows authenticated platform
Improper access control in AutoGPT’s webhook ping endpoint allows any authenticated user to enumerate other users’ webho
Memory amplification denial-of-service in AutoGPT's ExtractTextInformationBlock enables authenticated users to exhaust s
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today