CVE-2026-108819
Deferred Deferred - Pending Action

Code Execution Flaw in agno-agi Agent Orchestration Layer

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performing a manipulation of the argument code results in dynamically-managed code resources. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108819
EUVD
EUVD-2026-97318

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
agno-agi agno 3.0.0
agno-agi agno 3.0.1
agno-agi agno 3.0.2
agno-agi agno 3.0.3
agno-agi agno 3.0.4
agno-agi agno 3.0.5
agno-agi agno 3.0.6
agno-agi agno 3.1.0
agno-agi agno 3.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-913 The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a critical security flaw in the agno agent orchestration framework (CVE-2026-108819) where tool calls requested by an AI model are executed immediately without any default confirmation or human oversight. This allows arbitrary code execution if an attacker influences the model's output, such as through prompt injection. The issue stems from the framework's default configuration, which lacks a policy check between the model's decision to call a tool and the actual execution of that tool.

Detection Guidance

Check if agno versions up to 3.0.6 are installed by running: pip show agno-agi or agno. Verify if PythonTools with code-executing functions like run_python_code are registered without confirmation gates. Monitor logs for immediate tool execution without user prompts.

Impact Analysis

An attacker could exploit this vulnerability to execute arbitrary code with the privileges of the Python process hosting agno. This could allow reading sensitive files, writing or deleting files, installing persistence, or making network connections, all without user interaction or confirmation. The impact is severe as it enables full system compromise through prompt injection attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. The lack of safeguards for code execution may result in data breaches, unauthorized modifications, or exfiltration of regulated data, posing significant compliance risks.

Mitigation Strategies

Disable code-executing tools like run_python_code in agno configurations. Implement default-deny policies for tool calls. Enable confirmation gates for high-risk tools. Restrict untrusted content processing. Apply pull request #10523 if available to enforce confirmation by default.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108819. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart