CVE-2026-22038

HIGH

AutoGPT <autogpt-platform-beta-v0.6.46 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-22038. PoCs published by sivaadityacoder.

AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2026-22038, an information disclosure vulnerability in AutoGPT's Stagehand integration where API keys are logged in plaintext. It includes vulnerable code snippets, root cause analysis, and mitigation strategies.

Description

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.46, the AutoGPT platform's Stagehand integration blocks log API keys and authentication secrets in plaintext using logger.info() statements. This occurs in three separate block implementations (StagehandObserveBlock, StagehandActBlock, and StagehandExtractBlock) where the code explicitly calls api_key.get_secret_value() and logs the result. This issue has been patched in autogpt-platform-beta-v0.6.46.

Exploits (1)

github WRITEUP
by sivaadityacoder · poc
https://github.com/sivaadityacoder/CVE-2026-22038

This repository provides a detailed technical analysis of CVE-2026-22038, an information disclosure vulnerability in AutoGPT's Stagehand integration where API keys are logged in plaintext. It includes vulnerable code snippets, root cause analysis, and mitigation strategies.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: AutoGPT Platform (Stagehand integration) up to autogpt-platform-beta-v0.6.45
No auth needed
Prerequisites: Access to log files containing the exposed API keys
devstral-2 · analyzed Apr 25, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 8.1
EPSS 0.0043
EPSS Percentile 34.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-532
Status published
Products (1)
agpt/autogpt_platform < 0.6.46
Published Feb 04, 2026
Tracked Since Feb 18, 2026