CVE-2026-33233 Details
Description
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.6.34 through 0.6.51, the backend deserializes Redis cache bytes using pickle.loads without integrity/authenticity checks. The write path serializes values with pickle.dumps(...) into Redis and the read path blindly invokes pickle.loads(...) on bytes with no HMAC/signature or strict schema validation gating deserialization. If an attacker can poison a shared-cache key in Redis, arbitrary command execution is possible in the backend container context, affecting confidentiality, integrity, and availability. This issue has been fixed in version 0.6.52.
A vulnerability exists in the AutoGPT workflow automation platform, specifically in the backend component, versions 0.6.34 prior to 0.6.51. The issue arises from the backend's deserialization of Redis cache bytes using pickle.loads, without proper integrity or authenticity checks. This flaw allows an attacker to poison a shared-cache key in Redis, potentially leading to arbitrary command execution within the backend container context. The vulnerability impacts the application's confidentiality, integrity, and availability.
Users are advised to update to AutoGPT version 0.6.52, where this vulnerability has been fixed. Additionally, replace pickle serialization in shared cache with safer formats like JSON or MsgPack, and implement strict schema validation. If binary serialization is necessary, verify cryptographic signatures using HMAC before decoding. It is also recommended to harden the Redis deployment by enforcing authentication and TLS, restricting exposure, and isolating cache network access.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-rfg2-37xq-w4m9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.52 | [email protected] | Release NotesVendor |
| https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-rfg2-37xq-w4m9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Significant-Gravitas AutoGPT | >= 0.6.34, <= 0.6.51 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |