CVE-2026-108818: Missing Authentication in agno-agi agno

This vulnerability affects the agno-agi agno software in versions 2.7.0 through 2.7.3 and 3.0.0 through 3.0.6. The flaw is located in the get_authentication_dependency function of auth.py, where improper handling of the security_key argument leads to missing authentication checks. This allows an attacker to bypass authentication remotely. Public exploit code exists, increasing the risk of exploitation. The project has been notified but no official fix or response has been provided to date.

An attacker can remotely exploit this vulnerability to bypass authentication mechanisms in the affected versions of agno-agi agno. This could allow unauthorized access to protected resources or functionality within the application. The availability of public exploit code increases the likelihood of exploitation, although no known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official channels for updates. Until a patch is available, consider implementing additional access controls or network-level restrictions to limit exposure.