CVE-2026-56663: AutoGPT Platform SSRF Vulnerability

CVE-2026-56663 Overview

CVE-2026-56663 is a Server-Side Request Forgery (SSRF) vulnerability in AutoGPT, a workflow automation platform for creating, deploying, and managing continuous AI agents. The flaw affects all AutoGPT Platform deployments prior to version 0.6.52. An authenticated user can bypass the private-IP protections in SendWebRequestBlock and reach internal network services. The vulnerability is tracked under [CWE-918] and carries a CVSS 3.1 score of 8.5.

Critical Impact
Authenticated attackers can bypass SSRF protections to access internal IPv4 endpoints, including cloud metadata services and CGNAT ranges, leading to confidentiality, integrity, and availability compromise.

Affected Products

AutoGPT Platform versions prior to 0.6.52
All AutoGPT Platform deployments using SendWebRequestBlock
Any environment where backend/backend/util/request.py performs IP validation

Discovery Timeline

2026-06-26 - CVE-2026-56663 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-56663

Vulnerability Analysis

The vulnerability resides in the _is_ip_blocked() function in backend/backend/util/request.py. This function is responsible for enforcing SSRF protections in the SendWebRequestBlock component. The function fails to normalize IPv4-mapped IPv6 addresses before comparing resolved IPs against blocked IPv4 ranges. As a result, hostnames that resolve to an IPv4-mapped IPv6 representation pass validation and reach internal IPv4 endpoints.

A second gap compounds the issue. The blocklist does not cover special-use address ranges such as 100.64.0.0/10, which is reserved for Carrier-Grade NAT (CGNAT) under RFC 6598. Attackers can pivot to services deployed on these ranges, common in cloud and telecom environments.

Root Cause

The root cause is incomplete input normalization in the SSRF filter. The _is_ip_blocked() routine treats IPv4-mapped IPv6 addresses (for example ::ffff:169.254.169.254) as distinct from their IPv4 equivalents. It also lacks entries for CGNAT and other special-use ranges that should be treated as private. Both gaps allow attackers to reference internal targets while evading the deny list.

Attack Vector

An authenticated user configures a SendWebRequestBlock with a hostname under attacker control. The hostname resolves to an IPv4-mapped IPv6 address that corresponds to a blocked internal IPv4 target such as cloud instance metadata endpoints or CGNAT-hosted services. The block passes validation and issues the request against the internal endpoint, returning responses to the caller. The GitHub Security Advisory documents the affected function and remediation. See the GitHub Security Advisory for additional context.

Detection Methods for CVE-2026-56663

Indicators of Compromise

Outbound requests from AutoGPT worker processes to RFC 1918, 169.254.169.254, or 100.64.0.0/10 addresses
DNS queries resolving external hostnames to IPv4-mapped IPv6 addresses (::ffff:0:0/96)
SendWebRequestBlock executions targeting hostnames whose resolution changes between validation and connection

Detection Strategies

Instrument backend/backend/util/request.py and application logs to record final resolved IP addresses for every outbound request
Alert on any AutoGPT-originated traffic destined for link-local, loopback, private, or CGNAT ranges
Correlate authenticated user activity with unexpected internal HTTP requests initiated by agent workflows

Monitoring Recommendations

Forward AutoGPT application and network flow logs to a centralized analytics platform for continuous review
Baseline normal outbound destinations from AutoGPT deployments and alert on deviations toward internal ranges
Monitor cloud metadata service access (169.254.169.254, fd00:ec2::254) from AutoGPT workload identities

How to Mitigate CVE-2026-56663

Immediate Actions Required

Upgrade AutoGPT Platform to version 0.6.52 or later on all deployments
Restrict AutoGPT worker egress to a documented allowlist of external destinations at the network layer
Rotate any credentials or tokens exposed to cloud metadata endpoints reachable from AutoGPT workers

Patch Information

The maintainers fixed the vulnerability in AutoGPT 0.6.52. The patch normalizes IPv4-mapped IPv6 addresses before evaluation and extends the blocklist to include CGNAT (100.64.0.0/10) and other special-use ranges. Review the GitHub Security Advisory GHSA-8qc5-rhmg-r6r6 for release notes and code changes.

Workarounds

Place AutoGPT behind an egress proxy that enforces destination allowlisting and rejects IPv6 literals
Disable or restrict access to SendWebRequestBlock for untrusted authenticated users until the upgrade is applied
Apply host firewall rules that block outbound traffic from AutoGPT workers to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8, and 100.64.0.0/10

bash

# Example iptables egress restriction for AutoGPT workers
iptables -A OUTPUT -m owner --uid-owner autogpt -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner autogpt -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner autogpt -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner autogpt -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner autogpt -d 100.64.0.0/10 -j REJECT
ip6tables -A OUTPUT -m owner --uid-owner autogpt -d ::ffff:0:0/96 -j REJECT