CVE-2026-72922

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-72922
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72922.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72922
Aliases
  • GHSA-349p-3c3r-8mjr
Published
2026-08-11T14:32:11Z
Modified
2026-10-21T02:59:13Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N CVSS Calculator
Summary
AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification
Details

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogpt_platform/backend/backend/api/features/integrations/router.py webhook_ingress_generic route selected get_webhook_manager(provider) from the untrusted provider URL segment without verifying webhook.provider, allowing a request to /compass/webhooks/{webhook_id}/ingress to use CompassWebhookManager's inherited no-op BaseWebhooksManager.verify_signature instead of GenericWebhooksManager.verify_signature, bypass X-Webhook-Secret for a configured secret_token, and execute a generic webhook graph as its owner. This issue is fixed in version 0.6.70.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-287"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72922.json"
}
References

Affected packages

Git / github.com/significant-gravitas/autogpt

Affected ranges

Type
GIT
Repo
https://github.com/significant-gravitas/autogpt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c45b9e35817a2037fadeaa47924cf41681573c09
Fixed
646dd5b8cfad1206e92ec7bcc3b8312657e2a92e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.6.70"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "646dd5b8cfad1206e92ec7bcc3b8312657e2a92e"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "autogpt-platform-beta-v0.6.70",
            "range":  [
                {
                    "fixed":  "c45b9e35817a2037fadeaa47924cf41681573c09"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

agbenchmark-v0.*
agbenchmark-v0.0.10
agpt-platform-beta-v0.*
agpt-platform-beta-v0.1.0
agpt-platform-beta-v0.1.1
agpt-platform-beta-v0.2.0
autogpt-platform-beta-v0.*
autogpt-platform-beta-v0.2.2
autogpt-platform-beta-v0.3.2
autogpt-platform-beta-v0.3.3
autogpt-platform-beta-v0.3.4
autogpt-platform-beta-v0.4.0
autogpt-platform-beta-v0.4.1
autogpt-platform-beta-v0.4.10
autogpt-platform-beta-v0.4.11
autogpt-platform-beta-v0.4.2
autogpt-platform-beta-v0.4.3
autogpt-platform-beta-v0.4.4
autogpt-platform-beta-v0.4.5
autogpt-platform-beta-v0.4.8
autogpt-platform-beta-v0.4.9
autogpt-platform-beta-v0.5.0
autogpt-platform-beta-v0.5.1
autogpt-platform-beta-v0.6.0
autogpt-platform-beta-v0.6.1
autogpt-platform-beta-v0.6.10
autogpt-platform-beta-v0.6.11
autogpt-platform-beta-v0.6.12
autogpt-platform-beta-v0.6.13
autogpt-platform-beta-v0.6.14
autogpt-platform-beta-v0.6.15
autogpt-platform-beta-v0.6.16
autogpt-platform-beta-v0.6.17
autogpt-platform-beta-v0.6.18
autogpt-platform-beta-v0.6.19
autogpt-platform-beta-v0.6.2
autogpt-platform-beta-v0.6.20
autogpt-platform-beta-v0.6.21
autogpt-platform-beta-v0.6.22
autogpt-platform-beta-v0.6.26
autogpt-platform-beta-v0.6.28
autogpt-platform-beta-v0.6.29
autogpt-platform-beta-v0.6.30
autogpt-platform-beta-v0.6.31
autogpt-platform-beta-v0.6.32
autogpt-platform-beta-v0.6.33
autogpt-platform-beta-v0.6.34
autogpt-platform-beta-v0.6.35
autogpt-platform-beta-v0.6.36
autogpt-platform-beta-v0.6.37
autogpt-platform-beta-v0.6.38
autogpt-platform-beta-v0.6.39
autogpt-platform-beta-v0.6.4
autogpt-platform-beta-v0.6.40
autogpt-platform-beta-v0.6.41
autogpt-platform-beta-v0.6.42
autogpt-platform-beta-v0.6.43
autogpt-platform-beta-v0.6.46
autogpt-platform-beta-v0.6.47
autogpt-platform-beta-v0.6.48
autogpt-platform-beta-v0.6.49
autogpt-platform-beta-v0.6.5
autogpt-platform-beta-v0.6.50
autogpt-platform-beta-v0.6.51
autogpt-platform-beta-v0.6.52
autogpt-platform-beta-v0.6.53
autogpt-platform-beta-v0.6.54
autogpt-platform-beta-v0.6.55
autogpt-platform-beta-v0.6.56
autogpt-platform-beta-v0.6.57
autogpt-platform-beta-v0.6.58
autogpt-platform-beta-v0.6.59
autogpt-platform-beta-v0.6.6
autogpt-platform-beta-v0.6.60
autogpt-platform-beta-v0.6.62
autogpt-platform-beta-v0.6.63
autogpt-platform-beta-v0.6.64
autogpt-platform-beta-v0.6.65
autogpt-platform-beta-v0.6.66
autogpt-platform-beta-v0.6.68
autogpt-platform-beta-v0.6.69
autogpt-platform-beta-v0.6.7
autogpt-platform-beta-v0.6.8
autogpt-platform-beta-v0.6.9
v0.*
v0.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72922.json"