CVE-2026-33234 SSRF Vulnerability in AutoGPT Platform

CVE-2026-33234 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the AutoGPT Platform. The vulnerability exists within the 'SendEmailBlock' component, which accepts user-supplied SMTP server and port parameters. The platform performs standard IP blocklist enforcement for HTTP-based traffic, but the 'SendEmailBlock' utilizes the Python 'smtplib' library to initiate raw TCP connections, which bypass these protections.

An authenticated attacker can manipulate these parameters to scan internal network infrastructure. Because the application processes 'smtplib' connection errors and exposes them in the block execution output, an attacker can receive raw banner data, such as SSH, Redis, or MySQL service signatures. This enables internal network mapping, identification of running services, and enumeration of service versions, facilitating further targeted exploitation. The issue was addressed by Significant Gravitas in version 0.6.52.

Attack Chain

1. Attacker authenticates to the AutoGPT Platform via the API or dashboard.
2. Attacker invokes the 'SendEmailBlock' execution API via a POST request to /api/blocks/execute.
3. Attacker injects internal network IP addresses and arbitrary ports into the 'smtp_server' and 'smtp_port' input fields.
4. The 'SendEmailBlock' passes these inputs directly to the 'smtplib.SMTP()' function.
5. The backend initiates an unvalidated raw TCP connection to the specified internal target, bypassing the HTTP-layer IP filter.
6. The target service responds; if a service is listening, the response is captured as an SMTP greeting.
7. The application returns an 'SMTPConnectError' containing the raw service banner (e.g., SSH version string) to the attacker.
8. Attacker uses the leaked banner information to identify vulnerable services within the internal network.

Impact

Successful exploitation allows for the discovery and reconnaissance of internal network segments that should be unreachable from the application environment. This includes sensitive internal cloud metadata endpoints, management interfaces, and database services. The leakage of exact software versions enables attackers to prioritize follow-on attacks based on known CVEs.

Recommendation

1. Upgrade 'AutoGPT Platform' to version 0.6.52 or later to apply input validation and port restrictions for the SMTP configuration.
2. Implement outbound network egress filtering at the firewall or cloud VPC level to prevent the AutoGPT backend from reaching internal, non-SMTP infrastructure.
3. Monitor web server and API logs for high volumes of 'SMTPConnectError' entries or unusual 'smtp_server' inputs in block execution requests.