CVE-2026-108819 Details
Description
A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performing a manipulation of the argument code results in dynamically-managed code resources. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
A vulnerability exists in Agno-Agi versions through 3.0.6 and 3.1.1, specifically within the Agent Orchestration Layer. The issue arises because tool calls requested by the model are executed immediately, without a default confirmation step or policy check. This flaw can be exploited remotely, allowing an attacker to inject prompts that manipulate the model into executing arbitrary code via a tool call that reaches the Python 'exec' function, all without any authentication or user interaction.
A pull request has been made to address this vulnerability by requiring confirmation for code-executing tools by default. This change is currently pending acceptance.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Agno-agi/Agno/ | [email protected] | ProductSource CodeVendor |
| https://github.com/Agno-agi/Agno/issues/10053 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/agno-agi/agno/pull/10523 | [email protected] | Issue TrackingVendor |
| https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-agent-orchestration-missing-confirmation-gate-code-execution.md | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/cve/CVE-2026-108819 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/964164 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416596 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416596/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| agno-agi agno | <= 3.0.6 (semver) <= 3.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |