CVE-2026-108820

EUVD-2026-97319

12.10.2026, 10:16

A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function member_agent.run in the library libs/agno/agno/team/_default_tools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 39.18%

Common Weakness Enumeration

CWE-250 - Execution with Unnecessary Privileges
The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

References

https://github.com/Agno-agi/Agno/

https://github.com/Agno-agi/Agno/issues/10054

https://github.com/agno-agi/agno/pull/10124

https://github.com/ybyu-ieu/agno-security-advisories/blob/main/advisories/agno-team-delegation-without-scoping-or-confirmation.md

https://vuldb.com/cve/CVE-2026-108820

https://vuldb.com/submit/964165

https://vuldb.com/vuln/416597

https://vuldb.com/vuln/416597/cti