AVID-2026-R1687

Description

AutoGPT allows SSRF due to DNS Rebinding in requests wrapper (CVE-2025-31490)

Details

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1, AutoGPT allows SSRF due to DNS Rebinding in requests wrapper. AutoGPT is built with a wrapper around Python’s requests library, hardening the application against SSRF. The code for this wrapper can be found in autogpt_platform/backend/backend/util/request.py. The requested hostname of a URL which is being requested is validated, ensuring that it does not resolve to any local ipv4 or ipv6 addresses. However, this check is not sufficient, as a DNS server may initially respond with a non-blocked address, with a TTL of 0. This means that the initial resolution would appear as a non-blocked address. In this case, validate_url() will return the url as successful. After validate_url() has successfully returned the url, the url is then passed to the real request() function. When the real request() function is called with the validated url, request() will once again resolve the address of the hostname, because the record will not have been cached (due to TTL 0). This resolution may be in the “invalid range”. This type of attack is called a “DNS Rebinding Attack”. This vulnerability is fixed in 0.6.1.

Reason for inclusion in AVID: The CVE describes an SSRF vulnerability in AutoGPT, an AI platform/framework used to build and deploy AI agents. It is a software component in the AI stack, relevant to general-purpose AI systems, and represents a security vulnerability with a documented fix. Evidence includes CVE details, description, affected version, and fix version.

References

• NVD entry
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-wvjg-9879-3m7w
• https://github.com/Significant-Gravitas/AutoGPT/commit/66ebe4376eab3434af90808796b54c2139847b37

Affected or Relevant Artifacts

• Developer: OpenAI
• Deployer: OpenAI
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2025-04-14
• Version: 0.3.3
• AVID Entry