CVE-2025-53944: AutoGPT Platform Auth Bypass Vulnerability

CVE-2025-53944 Overview

CVE-2025-53944 is an authorization bypass vulnerability in the AutoGPT Platform, an open-source system for creating, deploying, and managing continuous AI agents. The flaw resides in the external API's get_graph_execution_results endpoint. The endpoint validates user ownership of the graph_id parameter but fails to verify ownership of the graph_exec_id parameter. Authenticated users can supply arbitrary execution IDs and retrieve execution results belonging to other tenants. The internal API correctly validates both parameters, isolating the issue to the externally exposed surface. Versions 0.6.15 and earlier are affected, and the issue is fixed in 0.6.16.

Critical Impact
Any authenticated AutoGPT user can read execution results from any other user's agent runs, exposing prompts, outputs, and any sensitive data processed by AI agents.

Affected Products

AutoGPT Platform versions 0.6.15 and below
AutoGPT Platform 0.6.13:beta (confirmed in NVD CPE data)
Significant-Gravitas AutoGPT external API consumers

Discovery Timeline

2025-07-30 - CVE-2025-53944 published to NVD
2025-07-30 - GitHub Security Advisory GHSA-x77j-qg2x-fgg6 released by Significant-Gravitas
2025-07-30 - Fix commit 309114a727baa2063357810d444e9a119f8dd7f6 merged in autogpt-platform-beta-v0.6.16
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53944

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) classified under [CWE-285] Improper Authorization and [CWE-639] Authorization Bypass Through User-Controlled Key. The external API endpoint get_graph_execution_results accepts two identifiers: a graph_id representing the agent definition and a graph_exec_id representing a specific execution instance. The endpoint enforces an ownership check on the graph_id but does not validate that the requested graph_exec_id belongs to a graph owned by the authenticated caller. Any authenticated user can pair their own graph_id with another user's graph_exec_id and receive that execution's results.

Root Cause

The root cause is missing authorization logic in the external API layer. Internal endpoints implement complete ownership validation across both parameters, but the external implementation diverged and only checked the graph identifier. The execution record lookup proceeds without joining ownership state, so the data layer returns results based solely on the supplied execution ID.

Attack Vector

Exploitation requires only an authenticated AutoGPT account and network access to the external API. An attacker authenticates normally, then issues requests to get_graph_execution_results while iterating or guessing graph_exec_id values belonging to other tenants. Because the request is structurally identical to legitimate traffic, it produces no authentication failures. The returned execution data may contain user prompts, intermediate agent state, API responses, and any sensitive content processed by victim agents.

No verified public proof-of-concept code is available. For technical details, review the GitHub Security Advisory GHSA-x77j-qg2x-fgg6 and the fix commit 309114a.

Detection Methods for CVE-2025-53944

Indicators of Compromise

Requests to the external API endpoint get_graph_execution_results where the authenticated user's graph_id does not historically correlate with the supplied graph_exec_id.
High-volume enumeration patterns against execution ID parameters from a single authenticated principal.
Access log entries showing successful responses for graph_exec_id values that have never appeared in that user's prior execution traffic.

Detection Strategies

Correlate API gateway logs with the AutoGPT execution database to flag responses where the returning execution's owner differs from the requesting user.
Baseline each user's set of legitimate graph_exec_id values and alert when API calls reference identifiers outside that set.
Apply rate-limit and anomaly detection rules to the external API for sequential or randomized execution ID enumeration.

Monitoring Recommendations

Capture full request and response metadata for /external/.../get_graph_execution_results and forward to a centralized log store for retrospective hunting.
Monitor for the AutoGPT Platform version string in deployment manifests to identify hosts still running 0.6.15 or earlier.
Audit external API access tokens and revoke any that exhibit cross-tenant access patterns since July 2025.

How to Mitigate CVE-2025-53944

Immediate Actions Required

Upgrade AutoGPT Platform to v0.6.16 or later, which contains commit 309114a enforcing ownership checks on graph_exec_id.
Rotate API tokens and user credentials for any AutoGPT tenant that processed sensitive data on a vulnerable version.
Review execution result access logs from deployment through the patch date for evidence of cross-tenant queries.

Patch Information

Significant-Gravitas released the fix in autogpt-platform-beta-v0.6.16. The corrective change is documented in commit 309114a727baa2063357810d444e9a119f8dd7f6, which adds the missing ownership validation for graph_exec_id in the external API to mirror the internal API behavior. Refer to the GitHub Security Advisory for the maintainer's full guidance.

Workarounds

Restrict access to the external API behind a reverse proxy that enforces per-user allowlists of known graph_exec_id values until the upgrade is applied.
Disable the external get_graph_execution_results endpoint and route consumers to the internal API, which validates both parameters.
Limit AutoGPT user accounts to trusted operators only, since exploitation requires authenticated access.

bash

# Upgrade AutoGPT Platform to the patched release
git fetch --tags
git checkout autogpt-platform-beta-v0.6.16
docker compose -f docker-compose.platform.yml down
docker compose -f docker-compose.platform.yml pull
docker compose -f docker-compose.platform.yml up -d

# Verify the fix commit is present
git log --oneline | grep 309114a