CVE-2026-22038

High

Description

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.46, the AutoGPT platform's Stagehand integration blocks log API keys and authentication secrets in plaintext using logger.info() statements. This occurs in three separate block implementations (StagehandObserveBlock, StagehandActBlock, and StagehandExtractBlock) where the code explicitly calls api_key.get_secret_value() and logs the result. This issue has been patched in autogpt-platform-beta-v0.6.46.

SeverityHigh

CVSS8.1

Exploit probability—

ProductAgpt Autogpt Platform

PublishedFeb 4, 2026

First seenFeb 4, 2026

Weakness typeCWE-532CWE-532

How to fix

Update

agpt autogpt_platform0.6.46 or later

Affected products

Product	Affected versions	Fixed in
agpt autogpt_platform	v < 0.6.46	0.6.46

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.