« Volver al listado

CVE-2026-30950

Estado: AplazadaAlta (7.1)—

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are vulnerable to Authenticated Session Hijacking via IDOR. If an authenticated attacker can determine the session_id of another user's session, they can take it over, reading any messages in it and locking the legitimate user out.

Leer descripción completaMostrar menos

The PATCH /sessions/{session_id}/assign-user endpoint authenticates the caller but never verifies session ownership: the service layer invokes the session lookup with user_id=None, which the data access layer interprets as a privileged/system call that bypasses the ownership filter, allowing any authenticated user to reassign an arbitrary session to themselves. This issue has been patched in version 0.6.51.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto autenticado (PR:L) a servicio que permite hijacking de sesiones de otros usuarios. Impacto: acceso a cuentas válidas (T1078) y lectura de mensajes (T1005). IDOR en endpoint /sessions/{session_id}/assign-user tras verificación incompleta.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementApplication Developer GuidanceActive Directory ConfigurationVulnerability ScanningUser TrainingUser Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Autogpt — AutogptAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-30950",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-30950",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-19T12:57:11.653348Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Significant-Gravitas",
          "product": "AutoGPT",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.6.36, < 0.6.51"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-18T23:16:33.190",
  "references": [
    {
      "url": "https://github.com/Significant-Gravitas/AutoGPT/commit/eca7b5e79370c34ed75e80badb824023d7d8629d",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-q58p-v9r9-7gqj",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-q58p-v9r9-7gqj",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are vulnerable to Authenticated Session Hijacking via IDOR. If an authenticated attacker can determine the session_id of another user's session, they can take it over, reading any messages in it and locking the legitimate user out. The PATCH /sessions/{session_id}/assign-user endpoint authenticates the caller but never verifies session ownership: the service layer invokes the session lookup with user_id=None, which the data access layer interprets as a privileged/system call that bypasses the ownership filter, allowing any authenticated user to reassign an arbitrary session to themselves. This issue has been patched in version 0.6.51."
    },
    {
      "lang": "es",
      "value": "AutoGPT es una plataforma de automatización de flujos de trabajo para crear, desplegar y gestionar agentes de inteligencia artificial continuos. Las versiones 0.6.36 a la 0.6.50 son vulnerables a un secuestro de sesión autenticada a través de IDOR. Si un atacante autenticado puede determinar el session_id de la sesión de otro usuario, puede tomar el control de esta, leyendo cualquier mensaje en ella y bloqueando al usuario legítimo. El endpoint PATCH /sessions/{session_id}/assign-user autentica al llamador pero nunca verifica la propiedad de la sesión: la capa de servicio invoca la búsqueda de sesión con user_id=None, lo que la capa de acceso a datos interpreta como una llamada privilegiada/de sistema que omite el filtro de propiedad, permitiendo a cualquier usuario autenticado reasignarse a sí mismo una sesión arbitraria. Este problema ha sido parcheado en la versión 0.6.51."
    }
  ],
  "lastModified": "2026-07-24T13:10:00.223",
  "sourceIdentifier": "security-advisories@github.com"
}