PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-33233 Significant-Gravitas CVE debrief

AutoGPT versions 0.6.34 through 0.6.51 use Python's pickle module for Redis cache serialization without integrity or authenticity verification. The backend serializes values with pickle.dumps and deserializes with pickle.loads without HMAC, signature, or strict schema validation. An attacker with ability to poison a shared Redis cache key can achieve arbitrary code execution in the backend container context. This affects confidentiality, integrity, and availability. The vulnerability was fixed in version 0.6.52.

Vendor
Significant-Gravitas
Product
AutoGPT
CVSS
HIGH 7.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-07-24
Advisory published
2026-05-19
Advisory updated
2026-07-24

Who should care

Organizations running AutoGPT platform versions 0.6.34 through 0.6.51 with Redis caching enabled; DevOps teams managing AutoGPT deployments; security teams monitoring for deserialization vulnerabilities in Python applications

Technical summary

The vulnerability exists in AutoGPT's backend cache handling between versions 0.6.34 and 0.6.51. The application uses Python's pickle module for serializing and deserializing cache values stored in Redis. The serialization path uses pickle.dumps without cryptographic signing, and the deserialization path uses pickle.loads without integrity verification or input validation. This creates a deserialization of untrusted data condition (CWE-502) where an attacker who can write to the Redis cache can inject malicious pickle payloads. When the backend retrieves and deserializes the poisoned cache entry, arbitrary Python code execution occurs within the backend container security context. The attack requires access to the Redis instance, which may be achievable through network exposure, compromised credentials, or other cache poisoning vectors in shared cache environments.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade AutoGPT to version 0.6.52 or later to obtain the deserialization fix
  • Audit Redis cache access controls to restrict write access to backend services only
  • Implement network segmentation to limit Redis exposure to trusted backend containers
  • Monitor Redis for anomalous key modifications or unexpected pickle-serialized payloads
  • Review application logs for deserialization errors or unexpected object types that may indicate exploitation attempts

Evidence notes

CVE published 2026-05-19. CVSS 3.1 vector: AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. CWE-94 (Improper Control of Generation of Code), CWE-345 (Insufficient Verification of Data Authenticity), CWE-502 (Deserialization of Untrusted Data). Fix confirmed in autogpt-platform-beta-v0.6.52 release.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-33233 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-33233

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-33233 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-33233

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.