CVE-2026-72922: AutoGPT Auth Bypass Vulnerability

CVE-2026-72922 Overview

CVE-2026-72922 is an authentication bypass vulnerability [CWE-287] in AutoGPT, the workflow automation platform for building and managing continuous AI agents. The flaw affects the webhook_ingress_generic route in autogpt_platform/backend/backend/api/features/integrations/router.py in versions prior to 0.6.70. The route selects the webhook manager based on the untrusted provider URL segment without verifying it against the stored webhook.provider. Attackers can route requests through providers that inherit the no-op BaseWebhooksManager.verify_signature, bypassing the X-Webhook-Secret check and executing a generic webhook graph as its owner. The issue is fixed in version 0.6.70.

Critical Impact
Unauthenticated remote attackers can bypass webhook signature verification and trigger execution of arbitrary generic webhook graphs, running as the graph owner.

Affected Products

AutoGPT Platform (Significant-Gravitas/AutoGPT) versions prior to 0.6.70
AutoGPT Platform backend webhook ingress endpoints for the compass and generic providers
Deployments exposing /compass/webhooks/{webhook_id}/ingress to untrusted networks

Discovery Timeline

2026-08-11 - CVE-2026-72922 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72922

Vulnerability Analysis

AutoGPT registers per-provider webhook managers derived from BaseWebhooksManager. Each subclass implements verify_signature to validate a shared secret, typically the X-Webhook-Secret header. The GenericWebhooksManager enforces this check, while providers that do not sign requests, such as CompassWebhookManager, inherit the base class no-op implementation.

The webhook_ingress_generic route derives the manager from the provider value in the URL path via get_webhook_manager(provider). It then loads the webhook record by webhook_id without confirming that the loaded webhook.provider matches the URL segment. An attacker who knows or guesses a webhook_id for a generic provider webhook can invoke it through the compass path. The Compass manager's inherited no-op verifier runs, silently succeeds, and the generic graph executes as the owner.

Root Cause

The root cause is missing authentication [CWE-287] caused by trusting an unverified path parameter for security-critical dispatch. The code selects the signature verifier based on the URL provider rather than the persisted webhook.provider field, letting a caller downgrade signature enforcement.

Attack Vector

Exploitation requires only network access to the AutoGPT backend and a valid webhook_id. The attacker issues an HTTP POST to /compass/webhooks/{webhook_id}/ingress with an arbitrary body and no valid X-Webhook-Secret. The backend loads a generic webhook, invokes Compass's no-op verifier, and runs the graph payload under the owner's identity and credentials.

python

     webhook_manager = get_webhook_manager(provider)
     try:
         webhook = await get_webhook(webhook_id, include_relations=True)
-        user_id = webhook.user_id
+        # Sanity check: `provider` from URL and fetched webhook must match.
+        # Otherwise the URL provider's verifier runs instead of the webhook's
+        # own (a no-op for unsigned providers like Compass), bypassing it.
+        if webhook.provider.value.lower() != provider.value.lower():
+            logger.warning(
+                f"Webhook #{webhook_id} provider mismatch: "
+                f"registered as {webhook.provider.value}, ingress via {provider.value}"
+            )
+            # Same as the actual "webhook not found" response to conceal existence
+            raise NotFoundError(f"Webhook #{webhook_id} not found")
+    except NotFoundError as e:
+        logger.warning(f"Webhook payload received for unknown webhook #{webhook_id}")
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=str(e))
+    logger.debug(f"Webhook #{webhook_id}: {webhook}")
+
+    user_id = webhook.user_id
+    try:
         credentials = (
             await creds_manager.get(user_id, webhook.credentials_id)
             if webhook.credentials_id

Source: GitHub Commit 646dd5b. The patch rejects requests where the URL provider does not match the stored webhook.provider, returning a 404 to avoid disclosing webhook existence.

Detection Methods for CVE-2026-72922

Indicators of Compromise

POST requests to /compass/webhooks/{webhook_id}/ingress where the webhook was registered as a generic provider.
Missing or invalid X-Webhook-Secret header on requests that still result in successful graph execution.
Webhook graph executions triggered without preceding legitimate integration activity from the registered provider.

Detection Strategies

Cross-reference backend access logs against the webhook provider registry to flag requests where the URL provider differs from the stored webhook.provider.
Alert on webhook_ingress_generic invocations that produce a graph execution with no matching signature verification event in application logs.
Baseline expected callers and source IP ranges for each provider path, then alert on unexpected sources reaching /compass/webhooks/*.

Monitoring Recommendations

Enable debug logging around get_webhook_manager and webhook signature verification to capture provider mismatches.
Forward AutoGPT backend logs and reverse proxy access logs to a centralized analytics platform for correlation.
Track counts of 200 responses on /compass/webhooks/* endpoints and investigate spikes.

How to Mitigate CVE-2026-72922

Immediate Actions Required

Upgrade the AutoGPT platform backend to version 0.6.70 or later.
Restrict inbound access to webhook ingress endpoints to known provider egress IP ranges via a reverse proxy or WAF.
Rotate any secret_token values used for generic webhooks that may have been referenced by exposed webhook_id values.
Review recent graph execution logs for unexpected runs initiated through the /compass/webhooks/* path.

Patch Information

The fix is included in autogpt-platform-beta-v0.6.70. See the GitHub Release Note, the GitHub Pull Request #13559, and the GitHub Security Advisory GHSA-349p-3c3r-8mjr for full details. The patch adds a check that rejects ingress when the URL provider does not match the persisted webhook.provider.

Workarounds

Block external access to the /compass/webhooks/* route at the reverse proxy until the upgrade is applied.
Enforce authentication or IP allow-listing at the network edge for all /webhooks/* ingress paths.
Temporarily disable the Compass integration if it is not in active use.

bash

# Nginx example: restrict compass webhook ingress to trusted CIDR ranges
location ~ ^/compass/webhooks/ {
    allow 203.0.113.0/24;   # Trusted provider egress range
    deny  all;
    proxy_pass http://autogpt_backend;
}