CVE-2025-22603

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior to autogpt-platform-beta-v0.4.2 contains a server-side request forgery (SSRF) vulnerability inside component (or block) `Send Web Request`. The root cause is that IPV6 address is not restricted or filtered, which allows attackers to perform a server side request forgery to visit an IPV6 service. autogpt-platform-beta-v0.4.2 fixes the issue.

• CWE-918

• https://boatneck-faucet-cba.notion.site/SSRF-of-AutoGPT-153b650a4d88804d923ad65a015a7d61Exploit, Third Party Advisory
• https://github.com/Significant-Gravitas/AutoGPT/blob/2121ffd06b26a438706bf642372cc46d81c94ddc/autogpt_platform/backend/backend/util/request.py#L11Product
• https://github.com/Significant-Gravitas/AutoGPT/commit/26214e1b2c6777e0fae866642b23420adaadd6c4Patch
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-4c8v-hwxc-2356Exploit, Patch, Vendor Advisory

Published

Mar 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22598WeGIA is a web manager for charitable institutions. A Stored…6.1
• CVE-2025-22599WeGIA is a web manager for charitable institutions. A Reflec…6.5
• CVE-2025-2260In NetX HTTP server functionality of Eclipse ThreadX NetX Du…7.5
• CVE-2025-22600WeGIA is a web manager for charitable institutions. A Reflec…6.5
• CVE-2025-22601Discourse is an open source platform for community discussio…3.1
• CVE-2025-22602Discourse is an open source platform for community discussio…6.1
• CVE-2025-22604Cacti is an open source performance and fault management fra…7.2
• CVE-2025-22605Coolify is an open-source and self-hostable tool for managin…7.8
• CVE-2025-22606Coolify is an open-source and self-hostable tool for managin…7.8
• CVE-2025-22607Coolify is an open-source and self-hostable tool for managin…5.5
• CVE-2025-22608Coolify is an open-source and self-hostable tool for managin…6.5
• CVE-2025-22609Coolify is an open-source and self-hostable tool for managin…10