CVE-2025-53944: falha de alta gravidade em Significant-Gravitas AutoGPT
AutoGPT Platform Exposes Graph Execution Results via Authorization Gap
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.5%
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the external API's get_graph_execution_results endpoint has an authorization bypass vulnerability. While it correctly validates user access to the graph_id, it fails to verify ownership of the graph_exec_id parameter, allowing authenticated users to access any execution results by providing arbitrary execution IDs. The internal API implements proper validation for both parameters. This is fixed in v0.6.16.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
Significant-Gravitas · AutoGPTCVEs relacionadas — Significant-Gravitas AutoGPT
No mesmo produto, das mais perigosas para as menos.
CVE-2026-24780HIGHAutoGPT is Vulnerable to RCE via Disabled Block ExecutionEPSS 1.3%CVE-2025-22603HIGHAutoGPT SSRF vulnerabilityEPSS 0.6%CVE-2026-26020CRITICALAutoGPT Affected by Remote Code Execution via Dynamic Module Import in Block Loading (__import__)EPSS 0.6%CVE-2026-26006MEDIUMRedos (Regular Expression Denial of Service) at Code Extraction Block in significant-gravitas/autogptEPSS 0.5%CVE-2025-31490HIGHAutoGPT allows SSRF due to DNS Rebinding in requests wrapperEPSS 0.5%CVE-2025-31491HIGHAutoGPT allows leakage of cross-domain cookies and protected headers in requests redirectEPSS 0.5%