CVE-2026-56823: AutoGPT Auth Bypass Vulnerability

CVE-2026-56823 Overview

CVE-2026-56823 is a broken access control vulnerability [CWE-284] in AutoGPT, a workflow automation platform for creating, deploying, and managing continuous AI agents. The flaw exists in the POST /api/integrations/webhooks/{webhook_id}/ping endpoint. The endpoint fetches the target webhook by primary key alone. It does not verify that the webhook belongs to the authenticated user making the request.

Any authenticated user can supply an arbitrary webhook_id to confirm webhook existence, leak the webhook's OAuth provider type, and in some cases trigger a ping delivery on behalf of another user. The vulnerability has an EPSS score of 0.15%.

Critical Impact
Authenticated users can enumerate arbitrary webhooks belonging to other tenants, disclose OAuth provider metadata, and trigger cross-tenant webhook ping deliveries.

Affected Products

AutoGPT by Significant Gravitas
AutoGPT workflow automation platform versions prior to the fixed release
Deployments exposing the /api/integrations/webhooks/{webhook_id}/ping endpoint

Discovery Timeline

2026-06-26 - CVE-2026-56823 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-56823

Vulnerability Analysis

The vulnerability resides in the webhook ping handler within AutoGPT's integrations subsystem. When a client issues a POST request to /api/integrations/webhooks/{webhook_id}/ping, the server retrieves the webhook record using only the supplied primary key. The handler omits an ownership check against the authenticated user's identity.

This is a classic Insecure Direct Object Reference (IDOR) pattern. Any user holding a valid session can iterate webhook_id values and interact with records they do not own. The server response reveals whether a given webhook exists and returns metadata including the OAuth provider type associated with the record.

Beyond information disclosure, the endpoint executes the ping delivery logic against the target webhook. This causes AutoGPT to dispatch a request to the URL registered by another user, effectively allowing one tenant to invoke another tenant's integration endpoint.

Root Cause

The root cause is missing authorization enforcement in the webhook retrieval logic. The database query filters on primary key only. It does not include a predicate binding the webhook to the requester's user_id. The endpoint relies on authentication alone and skips the horizontal access control step required for tenant isolation.

Attack Vector

Exploitation requires network access to the AutoGPT API and valid authenticated credentials. An attacker enumerates webhook identifiers, submits ping requests, and observes the responses. Successful requests confirm webhook existence and expose the OAuth provider type. In deployments where the ping delivery executes, the attacker triggers an outbound request from AutoGPT to another user's webhook target.

No verified public exploit code is available. Refer to the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-56823

Indicators of Compromise

Repeated POST requests to /api/integrations/webhooks/{webhook_id}/ping from a single authenticated session iterating sequential or randomized webhook_id values.
Ping deliveries originating from AutoGPT to webhook URLs that do not correlate with the initiating user's registered integrations.
API responses disclosing OAuth provider metadata to users who do not own the referenced webhook.

Detection Strategies

Correlate the user_id on the authenticated session with the owner_id of the webhook returned by ping endpoint responses. Any mismatch indicates exploitation.
Baseline normal webhook ping frequency per user and alert on volumetric anomalies consistent with enumeration.
Review application logs for HTTP 200 responses to /webhooks/{id}/ping where the requesting principal differs from the webhook owner.

Monitoring Recommendations

Enable verbose logging on the integrations subsystem to capture requester identity and target webhook ownership for every ping call.
Forward AutoGPT API logs to a centralized SIEM for cross-tenant access pattern analysis.
Monitor egress traffic from the AutoGPT host for unexpected outbound ping deliveries to third-party OAuth callback URLs.

How to Mitigate CVE-2026-56823

Immediate Actions Required

Upgrade AutoGPT to the patched release referenced in the GitHub Security Advisory GHSA-rq9m-xvc7-v9h6.
Audit application logs for prior calls to the webhook ping endpoint and identify cross-owner access attempts.
Rotate OAuth credentials for any webhook integrations whose provider type may have been disclosed to unauthorized parties.

Patch Information

The AutoGPT maintainers have released a fix that enforces ownership validation on the webhook ping endpoint. The patched handler filters webhook lookups by both webhook_id and the authenticated user's user_id, returning a 404 when the requester does not own the record. Consult the GitHub Security Advisory for the specific version numbers and commit references.

Workarounds

Restrict access to the /api/integrations/webhooks/{webhook_id}/ping endpoint at a reverse proxy or API gateway until the patch is applied.
Limit AutoGPT accounts to trusted internal users during the remediation window to reduce the attacker population.
Disable webhook integrations that are not actively required to shrink the exposed attack surface.

bash

# Example nginx block to restrict the vulnerable endpoint to trusted CIDR ranges
location ~ ^/api/integrations/webhooks/[^/]+/ping$ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://autogpt_backend;
}