CVE-2025-31494

LOW EPSS 23.2%
Published Apr 15, 20251y ago · Modified Jun 17, 20261w ago
3.5 CVSS 3.1
Low
Find Similar
Published Apr 15, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graph_id+graph_version. Additionally, there was no check prohibiting users from subscribing with another user's graph_id+graph_version. As a result, node execution updates from one user's graph execution could be received by another user within the same instance. This vulnerability does not occur between different instances or between users and non-users of the platform. Single-user instances are not affected. In private instances with a user white-list, the impact is limited by the fact that all potential unintended recipients of these node execution updates must have been admitted by the administrator. This vulnerability is fixed in 0.6.1.

CVSS Details

Base Score
3.5
Exploitability
2.1
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
23.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-284

Affected Products 1

VendorProductVersionRange
agptautogpt_platform* <0.6.1

References 3

  • github.com https://github.com/Significant-Gravitas/AutoGPT/pull/9660
    Issue TrackingPatch
  • github.com https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.1
    Release Notes
  • github.com https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-958f-37vw-jx8f
    PatchVendor Advisory

Remediation

  • github.com https://github.com/Significant-Gravitas/AutoGPT/pull/9660
    Issue TrackingPatch
  • github.com https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-958f-37vw-jx8f
    PatchVendor Advisory