CVE-2026-72922

This vulnerability in AutoGPT's webhook routing is fundamentally about trust boundary migration gone wrong. The routing layer receives a provider parameter from the incoming URL and uses it to select which WebhookManager implementation to instantiate—before any authentication check occurs. The selected manager's verify_signature method then becomes the authority on whether the request is legitimate. The critical detail is that CompassWebhookManager carries a no-op verify_signature. This wasn't a coding mistake—it reflected an organizational assumption that Compass is an internal trusted provider. That assumption held when Compass traffic arrived behind a network boundary. The vulnerability materialized when someone added a routing layer that let external attackers specify which manager to use. The fix—verifying that the incoming provider parameter matches the stored webhook.provider—restores the security boundary. But the deeper question is whether this routing architecture is sound at all: if URL parameters can drive implementation selection for security-critical components, you've created a single point of failure where the routing layer delegates trust to whatever implementation it happens to load. What makes this severe is the execution amplification. Webhook compromise in a workflow automation platform doesn't just expose data—it can trigger AI agent actions with whatever integrations that agent has access to. That's qualitatively different from a typical authentication bypass; you're moving from bypass to potential command injection into an autonomous system. For defenders: verify you're on 0.6.70 or later, check whether any other routes in your codebase use URL segments to select implementation classes without validating them against stored state, and audit for similar patterns where developer convenience (flexible routing) created asymmetric security exposure. The secret_token rotation question also matters—if the webhook token existed before this fix, treat it as potentially compromised and rotate it.

Reviewed through automated stages and approved by a human before publication.