What’s Vulnerable › Products

Significant-Gravitas AutoGPT vulnerabilities

32 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 32 published in the last 12 months.

Check whether your Significant-Gravitas AutoGPT version is affected

Latest Significant-Gravitas AutoGPT vulnerabilities

• CVE-2026-72922 — AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification (CVSS 8.2)
• CVE-2026-56823 — AutoGPT: IDOR in Webhook Ping Endpoint Allows Enumeration and Cross-User Ping Triggering (CVSS 5.4)
• CVE-2026-56663 — AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access (CVSS 8.5)
• CVE-2025-32423 — AutoGPT: There is a DoS vulnerability in ExtractTextInformationBlock (CVSS 5.3)
• CVE-2025-32394 — AutoGPT: There is a DoS vulnerability in AITextSummarizerBlock (CVSS 5.3)
• CVE-2026-33235 — AutoGPT: Denial of Service (DoS) via Resource Exhaustion in text templating features (CVSS 7.7)
• CVE-2026-55237 — AutoGPT SignUp Page has DOM-Based XSS and Open Redirect (CVSS 8.8)
• CVE-2025-32437 — AutoGPT has a DoS vulnerability in MediaDurationBlock (CVSS 8.7)
• CVE-2025-32436 — AutoGPT has a DoS vulnerability in AddAudioToVideoBlock (CVSS 7.1)
• CVE-2025-32424 — AutoGPT has a DoS vulnerability in ScreenshotWebPageBlock (CVSS 8.7)
• CVE-2025-32422 — AutoGPT has a DoS vulnerability in FileStoreBlock with StepThroughItemsBlock (CVSS 8.7)
• CVE-2025-32392 — AutoGPT has a DoS vulnerability in LoopVideoBlock (CVSS 8.7)
• CVE-2026-45023 — AutoGPT: Credit system bypassed via direct block execution in POST /api/blocks/{block_id}/execute (CVSS 5.4)
• CVE-2026-33234 — AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server (CVSS 5.0)
• CVE-2026-33233 — AutoGPT Platform: Remote Code Execution via Unsafe Pickle Deserialization of Redis Cache Entries (CVSS 7.6)
• CVE-2026-33232 — AutoGPT: Unauthenticated DoS via Disk Space Exhaustion (CVSS 7.5)
• CVE-2026-30950 — AutoGPT has Authenticated Session Hijacking via IDOR (CVSS 7.1)
• CVE-2025-32425 — AutoGPT has missing Docker log rotation on platform containers that allows host disk-exhaustion DoS (CVSS 5.5)
• CVE-2026-26020 — AutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__) (CVSS 8.8)
• CVE-2026-26006 — Redos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogpt (CVSS 6.5)
• CVE-2025-32393 — AutoGPT has a DoS vulnerability in ReadRSSFeedBlock (CVSS 6.5)
• CVE-2026-22038 — AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks (CVSS 8.1)
• CVE-2025-62616 — AutoGPT has SSRF vulnerability in SendDiscordFileBlock (CVSS 9.8)
• CVE-2025-62615 — AutoGPT has SSRF vulnerability in ReadRSSFeedBlock (CVSS 9.8)
• CVE-2026-24780 — AutoGPT is Vulnerable to RCE via Disabled Block Execution (CVSS 8.8)