CVE-2025-22603 AutoGPT SSRF vulnerability

High 7.7 Published 10 Mar 2025 Updated 10 Mar 2025

Attackers can exploit an SSRF vulnerability in AutoGPT's web request component to access internal IPv6 services, potentially exposing sensitive data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-22603?

CVE-2025-22603 is a high-severity server-side request forgery vulnerability in Significant-Gravitas AutoGPT, published on 10 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior to autogpt-platform-beta-v0.4.2 contains a server-side request forgery (SSRF) vulnerability inside component (or block) `Send Web Request`. The root cause is that IPV6 address is not restricted or filtered, which allows attackers to perform a server side request forgery to visit an IPV6 service. autogpt-platform-beta-v0.4.2 fixes the issue.

Weakness: CWE-918

Which versions are affected by CVE-2025-22603?

It affects 1 product.

Products include Agpt Autogpt Platform.

How do I fix CVE-2025-22603?

No fix has been published for CVE-2025-22603 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-22603 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-22603 exists.

Sources

Also known as GHSA-4c8v-hwxc-2356.