CVE-2026-56663 AutoGPT: SSRF-to-RCE Chain in `SendWebRequestBlock` via IP validation bypass and internal `pg-meta` access
Authenticated attackers can bypass SSRF protections to access internal services, potentially leading to remote code execution in AutoGPT.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56663?
CVE-2026-56663 is a high-severity server-side request forgery vulnerability in Significant-Gravitas AutoGPT, published on 26 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.52, an authenticated user can bypass the SSRF / private-IP protections in SendWebRequestBlock and reach internal network services. _is_ip_blocked() in backend/backend/util/request.py does not normalize IPv4-mapped IPv6 addresses before checking resolved IPs against the blocked IPv4 ranges, and does not block special-use ranges such as 100.64.0.0/10 (CGNAT, RFC 6598). A hostname that resolves to an IPv4-mapped IPv6 address therefore passes validation and the request reaches the embedded internal IPv4 endpoint. This affects all AutoGPT Platform deployments. This vulnerability is fixed in 0.6.52.
Weakness: CWE-918
Which versions are affected by CVE-2026-56663?
How do I fix CVE-2026-56663?
No fix has been published for CVE-2026-56663 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-56663 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56663 exists.
Sources
Also known as GHSA-8qc5-rhmg-r6r6.