CVE-2026-56663: AutoGPT SSRF Bypass via IPv6 Mapping and CGNAT Ranges

Technical summary

The vulnerability resides in the _is_ip_blocked() function within backend/backend/util/request.py. The SendWebRequestBlock component is designed to prevent Server-Side Request Forgery (SSRF) attacks by filtering requests destined for private and reserved IP ranges. However, the implementation has two critical gaps: (1) it does not normalize IPv4-mapped IPv6 addresses (such as ::ffff:192.168.1.1) before validation, allowing these addresses to bypass the blocklist, and (2) it fails to block special-use IPv4 ranges including 100.64.0.0/10 (CGNAT per RFC 6598), which are commonly used in containerized and cloud environments. When a hostname resolves to an IPv4-mapped IPv6 address, the validation passes and the HTTP request proceeds to the internal endpoint. This affects all AutoGPT Platform deployments running versions prior to 0.6.52.

Business impact

An authenticated attacker can use this vulnerability to circumvent network segmentation and access internal services that should be isolated. In a typical AutoGPT deployment, this could lead to reconnaissance of internal infrastructure, lateral movement, data exfiltration from backend systems, or abuse of internal APIs and services. The impact is amplified in cloud and containerized environments where CGNAT ranges are standard. Since the attack requires valid credentials, the threat is greatest from compromised user accounts or malicious insiders, but in shared or multi-tenant environments the risk extends to any authenticated user. Organizations relying on AutoGPT for sensitive workflow automation face potential data loss, compliance violations, and operational disruption.

Affected systems

All AutoGPT Platform deployments with versions prior to 0.6.52 are vulnerable. This includes both on-premises and cloud-hosted instances. The vulnerability is present across all deployment topologies because the flaw is in core request validation logic. Organizations using AutoGPT for AI-driven automation—particularly those integrating it with internal services, APIs, or databases—should prioritize assessment and patching.

Exploitability

The attack requires authentication (the CVSS vector reflects PR:L), meaning an attacker must possess valid user credentials. However, the barrier to exploitation is relatively low once credentials are obtained: the attacker simply crafts a workflow or API call that directs a web request to an IPv4-mapped IPv6 address or CGNAT-range hostname pointing to an internal service. No special tools, zero-days, or sophisticated techniques are needed. The vulnerability is deterministic and reliable given knowledge of internal network topology. In environments where credentials are shared, weak, or stolen, the practical risk is substantially elevated.

Remediation

Upgrade AutoGPT Platform to version 0.6.52 or later as soon as feasible. This version includes a corrected _is_ip_blocked() function that properly normalizes IPv4-mapped IPv6 addresses and blocks special-use ranges including CGNAT. Verify the upgrade by checking the version number in the AutoGPT UI or via the API. Additionally, apply network-layer defenses: restrict outbound connections from AutoGPT instances to only approved external services, use host-based firewalls or network policies to prevent access to internal subnets, and implement request logging and alerting on the SendWebRequestBlock component to detect suspicious patterns. Review user access controls and credential management to minimize the attack surface.

Patch guidance

Patch to version 0.6.52 or later. Review the AutoGPT release notes and advisory to confirm the patch addresses the _is_ip_blocked() function. Test the upgrade in a staging environment first to ensure compatibility with existing workflows and integrations. After deployment, validate that internal IP ranges (private and CGNAT) are properly blocked by testing a request to an internal service with an IPv4-mapped IPv6 address (e.g., ::ffff:10.0.0.1). Monitor for any service disruptions and review logs for evidence of exploitation attempts prior to patching.

Detection guidance

Monitor HTTP request logs from AutoGPT for outbound requests with IPv6 addresses, particularly those containing ::ffff: prefixes that map to private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or CGNAT ranges (100.64.0.0/10). Alert on any requests from authenticated users targeting internal IPs via SendWebRequestBlock. Review workflow definitions and API calls for hostname or IP parameters that might resolve to internal services. Check network flow logs for unexpected internal connections originating from AutoGPT containers or processes. Correlate these logs with user account activity to identify potentially compromised credentials or malicious actors.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.5), wide scope of impact across all AutoGPT deployments, and the confluence of authenticated access with network boundary bypass. The fix is straightforward and available, making remediation feasible without operational complexity. The risk is especially acute for organizations in regulated industries or those using AutoGPT to orchestrate access to sensitive systems. Early patching prevents both targeted exploitation and opportunistic abuse.

Risk score, explained

The CVSS 3.1 score of 8.5 (HIGH) reflects a network-accessible vulnerability requiring authentication (PR:L) but with high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) and a changed scope (S:C), meaning exploitation can affect systems beyond the vulnerable component. The score appropriately penalizes the authentication requirement but recognizes that once a user is authenticated, the attacker can easily reach internal services and potentially compromise backend infrastructure. The AC:H (attack complexity) reflects that the attacker must know or guess the correct IPv4-mapped IPv6 address or CGNAT hostname, a modest barrier but not a dealbreaker in reconnaissance scenarios.

Frequently asked questions