CVE-2026-56823: AutoGPT Webhook Access Control Vulnerability (CVSS 5.4)

Technical summary

The POST /api/integrations/webhooks/{webhook_id}/ping endpoint performs insufficient authorization checks. It retrieves webhook records based solely on the provided webhook_id parameter without validating ownership against the authenticated user's tenant or account context. This creates two attack vectors: (1) information disclosure through webhook enumeration and OAuth provider type leakage via error responses or response variations, and (2) potential state modification if the ping operation executes webhook delivery callbacks without proper scope validation. The vulnerability aligns with CWE-284 (Improper Access Control) and CWE-639 (Authorization Bypass Through User-Controlled Key), both of which describe scenarios where authorization decisions fail to verify resource ownership.

Business impact

Organizations using AutoGPT for multi-tenant or team-based workflows face insider risk amplification. An employee with platform access can discover integration configurations belonging to other teams, potentially exposing the OAuth providers or SaaS platforms their organization connects to. In regulated environments, this information disclosure may constitute compliance violations (e.g., HIPAA, SOC 2). While the vulnerability does not grant direct access to connected services, it enables reconnaissance that could inform social engineering or targeted supply-chain attacks. The ability to trigger webhook pings on behalf of others could disrupt automation workflows or trigger unintended downstream actions in integrated systems.

Affected systems

All versions of AutoGPT prior to the fix are affected. The vulnerability is specific to the webhook ping endpoint and affects any deployment where multiple authenticated users or teams share the same AutoGPT instance. Standalone single-user deployments have lower risk, but organizations running AutoGPT in shared environments should assume all webhook configurations are exposed to enumeration by any authenticated user.

Exploitability

Exploitation requires valid authentication credentials, which limits the attack surface to insider threats or compromised user accounts. However, the attack is trivial to execute—a simple script iterating through webhook IDs via POST requests requires no special knowledge or tooling. No user interaction is needed. The CVSS score of 5.4 (MEDIUM) reflects the combination of low barrier to entry for authenticated users and moderate impact (information disclosure and limited state change). The vulnerability is not currently tracked in the Known Exploited Vulnerabilities (KEV) catalog and has no evidence of public exploitation as of the publication date.

Remediation

Apply the patched version of AutoGPT when available from the vendor. The fix implements proper authorization checks to ensure that only the webhook owner (or a user with explicit delegation rights) can access or trigger webhook operations. Organizations should verify patch availability through the official AutoGPT release channel before deploying. Additionally, implement application-level controls: audit webhook access logs, restrict webhook creation to administrators, and use network segmentation to limit authenticated user counts where possible.

Patch guidance

Monitor the AutoGPT project repository and official security advisories for patched version availability. The description does not specify a version number; contact the vendor or check their security advisory for the exact patch version. Apply patches to all running instances, including development and staging environments. Test the patched endpoint behavior by confirming that users can only list and ping their own webhooks. Consider running an audit query against your webhook database to identify any misuse before patching.

Detection guidance

Monitor access logs for the POST /api/integrations/webhooks/{webhook_id}/ping endpoint. Flag requests where the webhook_id does not match the authenticated user's known webhooks. Examine response patterns for enumeration activity—a single user making repeated ping requests with sequential or pseudo-random IDs suggests reconnaissance. Check audit logs for webhook access by users outside the owning team. Network detection is challenging without visibility into AutoGPT logs; prioritize application-level telemetry and webhook operation audit trails.

Why prioritize this

Although CVSS 5.4 is MEDIUM severity, this vulnerability warrants prompt patching because it enables horizontal enumeration of sensitive integration metadata in multi-tenant environments. Insider threat scenarios and compromised account compromise could expose OAuth provider configurations, which are often reused across services. The low complexity of exploitation and the information disclosure risk justify treating this as high-priority in shared AutoGPT deployments. Organizations with single-user or isolated instances can deprioritize relative to critical or high-severity vulnerabilities.

Risk score, explained

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N yields a score of 5.4 MEDIUM. Attack Vector is Network (AV:N), reflecting the endpoint's accessibility via HTTP. Attack Complexity is Low (AC:L), as no special conditions are required beyond valid credentials. Privileges Required (PR:L) indicates authentication is mandatory, limiting the attack to insiders or compromised accounts. User Interaction is None (UI:N), so no social engineering is needed. Scope is Unchanged (S:U), affecting only AutoGPT; downstream services are not directly in scope. Confidentiality Impact is Low (C:L) due to information disclosure of webhook existence and OAuth provider types. Integrity Impact is Low (I:L) because webhook pings can trigger unintended actions but do not allow direct data modification. Availability (A:N) is unaffected.

Frequently asked questions