CVE-2026-22038: fallo de gravedad alta en Significant-Gravitas AutoGPT
AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.1epss 0.5%
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.46, the AutoGPT platform's Stagehand integration blocks log API keys and authentication secrets in plaintext using logger.info() statements. This occurs in three separate block implementations (StagehandObserveBlock, StagehandActBlock, and StagehandExtractBlock) where the code explicitly calls api_key.get_secret_value() and logs the result. This issue has been patched in autogpt-platform-beta-v0.6.46.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Productos afectados
Significant-Gravitas · AutoGPTCVEs relacionadas — Significant-Gravitas AutoGPT
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-24780HIGHAutoGPT is Vulnerable to RCE via Disabled Block ExecutionEPSS 1.3%CVE-2025-22603HIGHAutoGPT SSRF vulnerabilityEPSS 0.6%CVE-2026-26020CRITICALAutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)EPSS 0.6%CVE-2025-53944HIGHAutoGPT Platform Exposes Graph Execution Results via Authorization GapEPSS 0.5%CVE-2026-26006MEDIUMRedos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogptEPSS 0.5%CVE-2025-31490HIGHAutoGPT allows SSRF due to DNS Rebinding in requests wrapperEPSS 0.5%