CVE-2026-22038: AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.46, the AutoGPT platform's Stagehand integration blocks log API keys and authentication secrets in plaintext using logger.info() statements. This occurs in three separate block implementations (StagehandObserveBlock, StagehandActBlock, and StagehandExtractBlock) where the code explicitly calls apikey.getsecretvalue() and logs the result. This issue has been patched in autogpt-platform-beta-v0.6.46.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22038?
CVE-2026-22038 is classified as a high severity vulnerability due to the exposure of API keys and secrets.
How do I fix CVE-2026-22038?
To fix CVE-2026-22038, upgrade to AutoGPT platform version v0.6.46 or later.
What are the implications of CVE-2026-22038?
The implications of CVE-2026-22038 include potential unauthorized access to services and data due to exposed API keys and secrets.
Which software versions are affected by CVE-2026-22038?
CVE-2026-22038 affects versions of AutoGPT prior to v0.6.46.
Is there a workaround for CVE-2026-22038?
There is no known workaround for CVE-2026-22038 other than upgrading to a patched version.