CVE-2026-72922 in AutoGPT
Summary
by MITRE • 08/11/2026
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogpt_platform/backend/backend/api/features/integrations/router.py webhook_ingress_generic route selected get_webhook_manager(provider) from the untrusted provider URL segment without verifying webhook.provider, allowing a request to /compass/webhooks/{webhook_id}/ingress to use CompassWebhookManager's inherited no-op BaseWebhooksManager.verify_signature instead of GenericWebhooksManager.verify_signature, bypass X-Webhook-Secret for a configured secret_token, and execute a generic webhook graph as its owner. This issue is fixed in version 0.6.70.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in AutoGPT versions prior to 0.6.70 represents a critical authentication and authorization bypass flaw that undermines the platform's security architecture for webhook processing. This weakness exists within the webhook_ingress_generic route located in autogpt_platform/backend/backend/api/features/integrations/router.py, where the system fails to validate the provider parameter extracted from the URL segment before selecting the appropriate webhook manager implementation. The flaw specifically affects the routing logic that determines which webhook manager to invoke based on the provider identifier, creating an opportunity for malicious actors to manipulate the system's behavior through crafted requests.
The technical execution of this vulnerability exploits the lack of input validation and proper authorization checks within the webhook processing pipeline. When a request is made to /compass/webhooks/{webhook_id}/ingress, the system retrieves the provider value directly from the URL path without verifying its legitimacy or ensuring it corresponds to an authorized webhook type. This allows an attacker to force the system to instantiate a CompassWebhookManager instead of the expected GenericWebhooksManager, which inherits from BaseWebhooksManager and implements a no-op signature verification mechanism. The absence of proper signature validation means that requests can bypass the required X-Webhook-Secret header verification that should normally authenticate webhook deliveries.
This vulnerability directly impacts the platform's security model by enabling unauthorized execution of webhook graphs with elevated privileges. When the system uses the CompassWebhookManager instead of GenericWebhooksManager, it effectively disables signature verification and allows any request to execute a generic webhook graph as if it were performed by the owner of that webhook configuration. This creates a privilege escalation scenario where external actors can manipulate the platform's workflow automation capabilities without proper authentication, potentially leading to unauthorized code execution, data manipulation, or system compromise. The bypass of the secret_token verification mechanism represents a fundamental failure in the platform's access control implementation.
The security implications extend beyond simple authentication bypass to encompass potential lateral movement and persistent access within the AutoGPT platform ecosystem. This flaw aligns with CWE-285 (Improper Authorization) and CWE-347 (Improper Verification of Cryptographic Signature), as it demonstrates both inadequate authorization checks and failure to properly verify webhook signatures. From an attacker perspective, this vulnerability maps to ATT&CK technique T1078.004 (Valid Accounts: Cloud Accounts) and T1566.002 (Phishing: Spearphishing Attachment), as it allows for exploitation of trusted webhook configurations to gain unauthorized access. The fix implemented in version 0.6.70 addresses this by enforcing proper provider validation, ensuring that only authorized webhook managers are instantiated based on verified provider identifiers.
Organizations using AutoGPT should prioritize immediate patching of affected versions to prevent exploitation of this vulnerability, as it provides a direct pathway for unauthorized execution of automated workflows. The remediation process requires implementing input validation for the provider parameter and establishing proper authorization checks before selecting webhook manager implementations. Additionally, security teams should conduct comprehensive audits of all webhook configurations and verify that signature verification mechanisms are properly enforced across all integration points within the platform. This vulnerability serves as a critical reminder of the importance of validating all user-provided inputs in security-sensitive contexts and implementing defense-in-depth strategies to prevent privilege escalation through authentication bypass mechanisms.