CVE-2026-108820
Deferred Deferred - Pending Action

Privilege Escalation in agno-agi agno via Delegation Feature

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function member_agent.run in the library libs/agno/agno/team/_default_tools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108820
EUVD
EUVD-2026-97319

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
agno-agi agno 3.0.0
agno-agi agno 3.0.1
agno-agi agno 3.0.2
agno-agi agno 3.0.3
agno-agi agno 3.0.4
agno-agi agno 3.0.5
agno-agi agno 3.0.6
agno-agi agno 3.1.0
agno-agi agno 3.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-250 The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-108820 is a privilege escalation flaw in the agno library (versions <= 3.0.6) affecting the Team delegation feature. When a leader delegates a task to a member agent, the member executes with the leader's full identity, session state, and toolset without scoping or confirmation. This allows member agents with dangerous tools to perform arbitrary operations under the leader's privileges, such as reading/writing files or executing commands, without oversight.

Detection Guidance

To detect this vulnerability, check if your agno library version is 3.0.6 or lower. Run commands like pip show agno-agi or pip list to verify the installed version. Inspect the library's libs/agno/agno/team/_default_tools.py file for the member_agent.run function and delegation logic without confirmation requirements.

Impact Analysis

An attacker could exploit this via prompt injection against a Team processing untrusted content, triggering delegation to a high-privilege member agent. This could lead to unauthorized file access, command execution, or secret exfiltration under the leader's identity. The lack of confirmation or scope restrictions means attacks can occur silently without audit trails.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access, modification, or exfiltration under elevated privileges. GDPR requires data protection and access controls, while HIPAA mandates strict access controls for sensitive health data. Unrestricted delegation undermines these controls, risking non-compliance and data breaches.

Mitigation Strategies

Immediately update agno to version 3.1.1 or later. If updating is not possible, disable the delegation feature or restrict member tools to non-privileged operations. Add manual confirmation requirements for delegated tasks and audit all delegation paths for excessive privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108820. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart