Webhook Exposure in AutoGPT by Significant Gravitas

CVE-2026-56823

What is CVE-2026-56823?

The AutoGPT platform introduces a security flaw in its webhook integration mechanism. Specifically, the POST /api/integrations/webhooks/{webhook_id}/ping endpoint can be exploited by any authenticated user. Without proper verification that the provided webhook_id belongs to the authenticated user, attackers can manipulate the endpoint to discover webhook details, such as the associated OAuth provider type. This vulnerability also has the potential to trigger undesirable ping deliveries on behalf of other users, increasing the risk of data exposure and unauthorized actions.

References