CVE-2026-65699 in AgentGPT
Summary
by MITRE • 07/23/2026
AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target run_id in the request body without ownership verification. The AgentCRUD.create_task and validate_task_count functions look up the target AgentRun using the client-supplied run_id without confirming the run belongs to the requesting user, enabling an attacker who obtains a valid run_id to corrupt task history, exhaust the per-run loop budget, and drive LLM costs against the victim's run.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability represents a critical authorization bypass in AgentGPT versions through 1.0.0 that stems from insufficient access control validation during task assignment operations. The flaw exists within the AgentCRUD.create_task and validate_task_count functions where the system accepts a client-supplied run_id parameter without performing proper ownership verification checks. This design oversight creates a scenario where authenticated users can manipulate task assignments to target agent runs belonging to other users, fundamentally undermining the application's access control mechanisms.
The technical implementation of this vulnerability manifests through the absence of user ownership validation when processing requests containing target run_id values. When an attacker discovers or otherwise obtains a valid run_id from another user, they can craft malicious requests that direct task creation operations against that victim's agent run. The system processes these requests without confirming that the requesting user has legitimate authorization to modify the specified run, creating a pathway for unauthorized interference with other users' computational resources.
The operational impact of this vulnerability extends beyond simple data manipulation to encompass significant resource abuse and financial implications. Attackers can corrupt task history by injecting malicious tasks into victim runs, potentially compromising the integrity of automated workflows and analysis results. More critically, they can exhaust per-run loop budgets that are typically allocated to individual users, effectively consuming computational resources that belong to other parties. This resource exhaustion directly translates to increased LLM costs for the victim user, creating a financial burden that may be substantial depending on the computational intensity of the agent operations.
The vulnerability aligns with CWE-862, which describes "Missing Authorization" conditions where access control checks are not properly enforced. From an adversarial perspective, this flaw maps directly to ATT&CK technique T1078.004, "Valid Accounts: Cloud Accounts," as it allows unauthorized access to another user's computational resources through legitimate authentication mechanisms. The attack vector requires minimal technical sophistication beyond obtaining a valid run_id, making it particularly dangerous in environments where such identifiers might be predictable or accessible through other means.
Mitigation strategies should focus on implementing robust ownership verification mechanisms that validate user permissions before processing any task assignment operations. The system must enforce strict access control checks that verify the requesting user's authorization to modify the target agent run before permitting any modifications. Additionally, implementing rate limiting and resource monitoring can help detect abnormal usage patterns that might indicate exploitation attempts. Organizations should also consider implementing proper session management and ensuring that run_id values are properly scoped to individual user contexts to prevent cross-user contamination of computational resources.