CVE-2025-22603 Overview
CVE-2025-22603 is a Server-Side Request Forgery (SSRF) vulnerability in the AutoGPT platform, an open-source system for building and managing autonomous AI agents. The flaw resides in the Send Web Request block within the AutoGPT backend. The request handler validates and filters IPv4 addresses but fails to restrict or filter IPv6 addresses. Attackers can abuse this gap to coerce the server into issuing requests to internal IPv6 services. All versions of autogpt-platform-beta prior to v0.4.2 are affected. The maintainers addressed the issue in autogpt-platform-beta-v0.4.2 [CWE-918].
Critical Impact
Unauthenticated attackers can leverage the SSRF to reach internal IPv6 services from the AutoGPT backend, compromising integrity of internal resources reachable over IPv6.
Affected Products
- AutoGPT Platform (agpt:autogpt_platform) beta releases prior to autogpt-platform-beta-v0.4.2
- The Send Web Request block in autogpt_platform/backend/backend/util/request.py
- Self-hosted AutoGPT deployments exposing the agent platform over the network
Discovery Timeline
- 2025-03-10 - CVE-2025-22603 published to NVD
- 2026-01-28 - Last updated in NVD database
Technical Details for CVE-2025-22603
Vulnerability Analysis
The AutoGPT platform exposes a workflow component called Send Web Request that issues HTTP requests to user-supplied URLs. To prevent SSRF, the backend implements address validation in autogpt_platform/backend/backend/util/request.py. The filter blocks private, loopback, and link-local IPv4 ranges before allowing the request to proceed.
The filter does not apply the same controls to IPv6 addresses. An attacker who supplies an IPv6 URL bypasses the SSRF check entirely. The server resolves the address and issues the outbound request to any reachable IPv6 endpoint, including internal services, loopback (::1), unique local addresses (fc00::/7), and link-local ranges (fe80::/10).
This class of bypass is common when allowlists assume IPv4 semantics. Dual-stack hosts and IPv6-enabled internal networks broaden the attack surface considerably. The vulnerability scope is limited to integrity impact, as the attacker controls the outbound request target and can interact with internal HTTP services.
Root Cause
The root cause is missing IPv6 address validation in the URL filter that guards the Send Web Request block. The original validation logic enumerated disallowed IPv4 ranges but did not call equivalent checks against ipaddress.IPv6Address objects. Any URL containing an IPv6 literal or a hostname resolving to an IPv6 address passed the check unmodified.
Attack Vector
An attacker with the ability to configure or trigger an AutoGPT agent that uses the Send Web Request block supplies a URL containing an IPv6 literal, such as a request targeting http://[::1]:port/ or a link-local address. The AutoGPT backend executes the request server-side and returns the response into the agent workflow, allowing the attacker to read responses from internal IPv6 services. No authentication or user interaction is required at the network layer beyond the ability to submit a block configuration.
For implementation specifics, refer to the GitHub Security Advisory GHSA-4c8v-hwxc-2356 and the original vulnerable request handler.
Detection Methods for CVE-2025-22603
Indicators of Compromise
- Outbound HTTP requests from the AutoGPT backend targeting IPv6 literals, especially loopback (::1), unique local (fc00::/7), or link-local (fe80::/10) ranges.
- Send Web Request block executions with URLs containing bracketed IPv6 addresses or hostnames that resolve to internal IPv6 endpoints.
- Unexpected connections from the AutoGPT service account to internal management interfaces, metadata services, or container orchestration APIs reachable over IPv6.
Detection Strategies
- Inspect AutoGPT application logs and reverse-proxy logs for URLs containing [ and ] brackets indicating IPv6 literals submitted to the Send Web Request block.
- Correlate network flow telemetry from the AutoGPT host with internal IPv6 destinations that fall outside the expected egress profile.
- Audit AutoGPT agent and block configurations for user-supplied URLs and review changes introduced after deployment.
Monitoring Recommendations
- Enable egress logging on the AutoGPT backend with capture of both IPv4 and IPv6 destinations and alert on private-range targets.
- Add detection rules to your SIEM matching outbound requests from the AutoGPT service to RFC 4193 and RFC 4291 reserved IPv6 ranges.
- Track the deployed AutoGPT platform version and alert when hosts run releases earlier than autogpt-platform-beta-v0.4.2.
How to Mitigate CVE-2025-22603
Immediate Actions Required
- Upgrade all AutoGPT platform instances to autogpt-platform-beta-v0.4.2 or later, which applies the patch in commit 26214e1.
- Inventory self-hosted AutoGPT deployments and identify any workflows that use the Send Web Request block.
- Review historical logs for SSRF attempts targeting IPv6 endpoints before applying the patch.
Patch Information
The fix is delivered in autogpt-platform-beta-v0.4.2. The patch updates the URL validation logic in autogpt_platform/backend/backend/util/request.py to reject disallowed IPv6 ranges in addition to IPv4. See the vendor commit and the GHSA-4c8v-hwxc-2356 advisory for full details.
Workarounds
- Disable IPv6 on the AutoGPT backend host or container until the platform is upgraded, preventing the SSRF from reaching IPv6 destinations.
- Place the AutoGPT backend behind an egress proxy that enforces an allowlist of approved external destinations for both IPv4 and IPv6.
- Restrict access to the AutoGPT platform UI and API to trusted users, limiting who can configure Send Web Request blocks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
