CVE-2026-72922

Name of the Vulnerable Software and Affected Versions AutoGPT versions prior to 0.6.70

Description AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. A path confusion issue exists in the webhook ingress generic route within autogpt platform/backend/backend/api/features/integrations/router.py. The system selects get webhook manager(provider) from an untrusted provider URL segment without verifying webhook.provider. This allows a request to the endpoint /compass/webhooks/{webhook id}/ingress to utilize the CompassWebhookManager inherited no-op BaseWebhooksManager.verify signature function instead of the GenericWebhooksManager.verify signature function. Consequently, an attacker can bypass the X-Webhook-Secret for a configured secret token and execute a generic webhook graph as its owner.

Recommendations Update AutoGPT to version 0.6.70.