CVE-2026-108820
agno-agi agno Delegation Feature _default_tools.py member_agent.run unnecessary privileges
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function member_agent.run in the library libs/agno/agno/team/_default_tools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
| CWE | CWE-250 |
| Vendor | agno-agi |
| Product | agno |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for agno-agi agno
Be the first to know when new medium vulnerabilities affecting agno-agi agno are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
agno-agi / agno
3.0.0 3.0.1 3.0.2 3.0.3 3.0.4 3.0.5 3.0.6 3.1.0 3.1.1
References
vuldb.com: https://vuldb.com/vuln/416597 vuldb.com: https://vuldb.com/vuln/416597/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108820 vuldb.com: https://vuldb.com/submit/964165 github.com: https://github.com/Agno-agi/Agno/issues/10054 github.com: https://github.com/agno-agi/agno/pull/10124 github.com: https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-team-delegation-without-scoping-or-confirmation.md github.com: https://github.com/Agno-agi/Agno/
Credits
🔍 Ybyu (VulDB User) VulDB CNA Team