Threat database

CVE-2026-108820 is a medium severity vulnerability in agno-agi agno versions 3.0.0 through 3.1.1. It involves execution with unnecessary privileges in the member_agent.run function within the Delegation Feature component. The vulnerability can be exploited remotely without user interaction. A public exploit exists, but a fix is pending acceptance of a pull request.

CVE-2026-108819 is a medium severity vulnerability in agno-agi agno versions 3.0.0 through 3.1.1. It affects the exec function of the Agent Orchestration Layer component, where manipulation of the argument code leads to dynamically-managed code resources. The vulnerability can be exploited remotely without authentication. Although an exploit is publicly available, a fix is pending acceptance of a pull request.

CVE-2026-108818 is a medium severity vulnerability in agno-agi agno versions 2.7.0 through 2.7.3 and 3.0.0 through 3.0.6. It involves missing authentication due to improper handling of the security_key argument in the get_authentication_dependency function within auth.py. The vulnerability can be exploited remotely without privileges or user interaction. Public exploit code exists, but no vendor response or patch is currently available.

CVE-2026-108817 is an OS command injection vulnerability in the agno-agi agno software up to version 3.0.9. The flaw exists in the function agno.CodingTools.run_shell within the CodingTools component, allowing remote attackers to manipulate the command argument and execute arbitrary OS commands. The vulnerability has been publicly disclosed and can be exploited remotely. Upgrading to version 3.0.10 resolves the issue.

CVE-2026-108816 is a medium severity code injection vulnerability in the agno-agi agno software up to version 3.0.6. The flaw exists in the run_python_code function of the python.py file within the PythonTools component. An attacker can remotely manipulate the code argument to inject and execute arbitrary code. Exploit code has been publicly disclosed, but there is no vendor response or patch available yet.

agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the delete_by_metadata() method. Attackers can exploit the unsafe f-string interpolation in clickhousedb.py to delete all rows, target specific rows, or extract information through error-based or blind SQL injection techniques.

Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. This has been patched in version 2.2.2.

A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the function MCPTools/MultiMCPTools in the library libs/agno/agno/tools/mcp.py of the component Model Context Protocol Handler. The manipulation of the argument command leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.