How an AutoGPT Email Block Became an SSRF Surface
You type `smtp_server: 10.0.0.5` into a text field.
AutoGPT doesn’t send an email.
It reaches into the internal network and returns:
`SSH-2.0-OpenSSH_8.9p1 Ubuntu`
AutoGPT, a project with over 160,000 GitHub stars, lets users build autonomous workflows that browse the web, write code, and send emails. But trust becomes a vulnerability when a platform assumes every feature is equally protected.
In CVE-2026-33234, I found that AutoGPT’s `SendEmailBlock` lets any authenticated user scan internal networks, grab service banners from SSH and other TCP services, and exfiltrate version information through structured error messages, all from a single text field labeled “SMTP Server.”
The Hunt
I audited AutoGPT’s block system, mapping every user-controlled input that could touch the network. The platform has dozens of blocks. Each one is a potential outbound connection.
The HTTP layer had real SSRF protection. An IP blocklist covered private networks, loopback, and cloud metadata. I threw every standard trick...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
