Executive brief
AutoGPT is an automation platform used to create and manage AI agents. A security flaw in the platform's email component allows users to bypass safety restrictions and connect to internal network resources that should be private. An attacker could use this to map out a company's internal servers, identify running services like databases, and gather technical details that could be used for further attacks.
Technical details
The SendEmailBlock in `autogpt_platform/backend/backend/blocks/email_block.py` accepts user-supplied `smtp_server` and `smtp_port` values and passes them directly to Python's `smtplib.SMTP()` without validation. This bypasses the platform's standard SSRF protections (validate_url_host and BLOCKED_IP_NETWORKS) which are enforced for other outbound request types. Because `smtplib` captures TCP banners from the target service and includes them in exception messages returned to the user interface, an authenticated attacker can perform non-blind port scanning and service fingerprinting of internal infrastructure, including loopback, private IP ranges, and cloud metadata endpoints. The vulnerability is fixed in version 0.6.52 by implementing IP validation and improved error handling.
Affected products
- Significant-Gravitas AutoGPT Platform (backend) 0.1.0 - 0.6.51
Timeline
- 2026-03-20: patched: Version 0.6.52 released
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-05-19: disclosed: NVD publication date