Authorization Bypass in AgentGPT via User-Controlled Key

Executive Summary

CVE-2026-65699 is an authorization bypass vulnerability in AgentGPT through version 1.0.0. It allows authenticated users to attach tasks to another user's agent run by supplying a target run_id in the request body without verifying ownership. The vulnerable functions, AgentCRUD.create_task and validate_task_count, fetch the target AgentRun using the provided run_id without confirming it belongs to the requesting user. This enables attackers with a valid run_id to corrupt task history, exhaust the per-run loop budget, and drive up LLM costs for the victim's run.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect AgentGPT logs for unauthorized task attachments or run_id manipulations. Check for requests where users submit run_id values not belonging to them. Look for patterns of task history corruption or unexpected LLM cost spikes. No specific commands are provided in the context, but monitoring API endpoints handling task creation for improper authorization checks may reveal exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to manipulate your task history, deplete your per-run loop budget, and incur unexpected costs on your account by attaching tasks to your agent run. Since run_id is a UUIDv4, it is not easily guessable, but the lack of ownership checks means the risk exists if an attacker obtains a valid run_id.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to user data through task manipulation. If an attacker exploits this flaw to alter task history or exhaust resources, it may lead to unauthorized data exposure or processing, violating confidentiality and integrity requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update AgentGPT to a patched version if available. Implement object-level authorization checks in the agent-task creation path to verify run_id ownership before processing requests. Ensure AgentRun.get() filters by user_id. Review and restrict API endpoints accepting run_id to authenticated users only. Monitor for suspicious task attachments or cost anomalies.

Useful 0 Not Useful 0