CVE-2025-62615 is a critical server side request forgery flaw in the AutoGPT Platform's RSS feed block, scored CVSS 9.8. The input URL was not filtered beyond its scheme. The fix is autogpt-platform-beta-v0.6.34, so upgrade and restrict outbound network access.
What's affected
The GitHub advisory says autogpt-platform-beta-v0.6.33 and earlier are affected, with a patched version of autogpt-platform-beta-v0.6.34. It was published on 4 February 2026. The weakness is CWE-918, server-side request forgery.
The cause, shown in the advisory, is in the code that reads an RSS feed. It checks that the address starts with http or https, and then passes the address straight to Python's standard URL opener. No check stops the address from pointing at the server itself or at internal hosts. A sister record, CVE-2025-62616, covers the same class in the Discord file block.
How to check if you're exposed
Find the version of AutoGPT Platform you deployed. For a container deployment, read the image or release tag. For a source checkout, look at the git tag or commit.
Anything at autogpt-platform-beta-v0.6.33 or older is affected. Then think about who can build agents. The flaw is reachable by a user who can configure an RSS block with a URL of their choice, so the risk depends on whether untrusted people can create or edit agents on your instance.
If you run the platform in a cloud account, also check what an internal request from the server could reach, such as the instance metadata service or admin consoles on the private network.
What to do now
- Upgrade to autogpt-platform-beta-v0.6.34 or later.
- Limit who can create and edit agents to trusted users.
- Apply egress rules to the platform's backend so it can reach only the destinations it needs. Block loopback, private ranges and cloud metadata addresses.
- Require the metadata service's stricter mode on your cloud instances, where your provider offers one.
- Review agent definitions for RSS and Discord blocks that point at internal addresses.
- Handle CVE-2025-62616 in the same upgrade.
Why it matters
The class is CWE-918, server-side request forgery. The server fetches a URL the user supplies, and because the request leaves from the server, it is trusted in ways the user's own machine is not. It can see services on localhost and the private network, and in cloud settings it may reach credentials from a metadata endpoint.
A scheme check, as the code did here, is a common first step and a common stopping point. It confirms that the address is a web address, but it says nothing about where the address points. A more careful fix resolves the host, checks the result against a deny list of internal ranges, and checks again after redirects.
The advisory for the sister bug points out that this repository already has an HTTP wrapper with SSRF protection, and that the unsafe code simply did not use it. That is a useful review habit for any codebase: look for direct uses of low level HTTP calls where a safe wrapper exists.
The platform is meant to run agents that act on people's behalf, so the server holds API keys and reaches many services. A server side request that is not filtered is therefore worth taking seriously. The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
The advisory describes a user supplying the URL to the block, so the user needs the ability to run or configure that block on your instance.
What blocks the attack at the network level?
Outbound rules that deny loopback, private ranges and cloud metadata addresses from the backend, as a layer under the upgrade.
Sources
Last reviewed: 19 October 2026.
