CVE-2026-33233

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.6.34 through 0.6.51, the backend deserializes Redis cache bytes using pickle.loads without integrity/authenticity checks. The write path serializes values with pickle.dumps(...) into Redis and the read path blindly invokes pickle.loads(...) on bytes with no HMAC/signature or strict schema validation gating deserialization. If an attacker can poison a shared-cache key in Redis, arbitrary command execution is possible in the backend container context, affecting confidentiality, integrity, and availability. This issue has been fixed in version 0.6.52.

• CWE-94
• CWE-345
• CWE-502

• https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.52
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-rfg2-37xq-w4m9
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-rfg2-37xq-w4m9

Published

May 19, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33228flatted is a circular JSON parser. Prior to version 3.4.2, t…9.8
• CVE-2026-33229XWiki Platform is a generic wiki platform offering runtime s…9.8
• CVE-2026-3323An unsecured configuration interface on affected devices all…7.5
• CVE-2026-33230NLTK (Natural Language Toolkit) is a suite of open source Py…6.1
• CVE-2026-33231NLTK (Natural Language Toolkit) is a suite of open source Py…7.5
• CVE-2026-33232AutoGPT is a workflow automation platform for creating, depl…7.5
• CVE-2026-33234AutoGPT is a workflow automation platform for creating, depl…5
• CVE-2026-33235AutoGPT is a workflow automation platform for creating, depl…7.7
• CVE-2026-33236NLTK (Natural Language Toolkit) is a suite of open source Py…8.1
• CVE-2026-33237WWBN AVideo is an open source video platform. Prior to versi…5.5
• CVE-2026-33238WWBN AVideo is an open source video platform. Prior to versi…4.3
• CVE-2026-3324Zohocorp ManageEngine Log360 versions 13000 through 13013 ar…8.2