CVE Explorer

CVE-2026-22038

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.46, the AutoGPT platform's Stagehand integration blocks log API keys and authentication secrets in plaintext using logger.info() statements. This occurs in three separate block implementations (StagehandObserveBlock, StagehandActBlock, and StagehandExtractBlock) where the code explicitly calls api_key.get_secret_value

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:b4f4eb2f4d049d38b35424b4f0b75fbde84df2b80b269c85f738cc79b59019ae

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"AutoGPT","vendor":"Significant-Gravitas","versions":[{"status":"affected","version":"< autogpt-platform-beta-v0.6.46"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:7019b2e0fb318b97d76652d9578d7666ec5994b1e2a6fddecd7a13e934a19785 · sha256:238316d574822097… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:7019b2e0fb318b97d76652d9578d7666ec5994b1e2a6fddecd7a13e934a19785 · sha256:238316d574822097… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion

{"cweId":"CWE-532","description":"CWE-532: Insertion of Sensitive Information into Log File","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:7019b2e0fb318b97d76652d9578d7666ec5994b1e2a6fddecd7a13e934a19785 · sha256:238316d574822097… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"name":"https://github.com/Significant-Gravitas/AutoGPT/commit/1eabc604842fa876c09d69af43d2d1e8fb9b8eb9","tags":["x_refsource_MISC"],"url":"https://github.com/Significant-Gravitas/AutoGPT/commit/1eabc604842fa876c09d69af43d2d1e8fb9b8eb9"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:7019b2e0fb318b97d76652d9578d7666ec5994b1e2a6fddecd7a13e934a19785 · sha256:238316d574822097… · /containers/cna/references/1

{"name":"https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-rc89-6g7g-v5v7","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-rc89-6g7g-v5v7"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:7019b2e0fb318b97d76652d9578d7666ec5994b1e2a6fddecd7a13e934a19785 · sha256:238316d574822097… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer