Description

A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulation of the argument security_key leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T09:16:43.473Z",
  "pubdate": "2026-10-12T09:16:43.473Z",
  "executiveSummary": "A critical security vulnerability has been identified in the agno-agi framework affecting versions up to 2.7.3 and 3.0.6. The flaw, categorized as a missing authentication vulnerability, allows unauthorized actors to bypass security controls by manipulating the 'security_key' argument within the 'get_authentication_dependency' function.\nThis vulnerability is reachable remotely, posing a significant risk to the integrity and confidentiality of systems utilizing the affected versions. Successful exploitation results in the complete bypass of authentication mechanisms, granting an attacker unauthorized access to protected functionalities without requiring valid credentials.\nGiven that the exploit is publicly available, the risk of exploitation is elevated. Organizations deploying affected versions of agno-agi are exposed to potential unauthorized system interaction, data exfiltration, or malicious manipulation. Despite early disclosure, the maintainers have not yet provided a corrective patch, necessitating immediate defensive measures to mitigate the attack surface.",
  "technicalDetails": "The vulnerability resides within the 'auth.py' module of the agno-agi framework, specifically within the implementation logic of the 'get_authentication_dependency' function. This function is responsible for validating the authenticity of incoming requests; however, it fails to properly sanitize or verify the 'security_key' argument during the authentication handshake.\nRoot Cause Analysis: The vulnerability stems from a logical flaw where the authentication dependency handler incorrectly trusts the 'security_key' input. Instead of performing a robust, server-side validation against a secure, stored secret, the implementation allows for the manipulation of this parameter to deceive the authentication logic. By providing a specifically crafted value, an attacker can coerce the function into returning a state that indicates successful authentication.\nAttack Flow: The exploitation is initiated remotely by sending a crafted HTTP request to an endpoint that leverages 'get_authentication_dependency' for access control. The attacker modifies the 'security_key' parameter within the request payload. Because the server-side code fails to implement rigorous verification, the 'get_authentication_dependency' function erroneously processes the supplied key, treating it as legitimate. Consequently, the application assumes the requester is authenticated, effectively bypassing all downstream security filters and authorization checks.\nAffected Components: The primary vulnerable component is the authentication middleware located in 'auth.py', specifically targeting the logic flow governed by 'get_authentication_dependency'. Versions identified as vulnerable include all iterations up to and including 2.7.3 and 3.0.6.\nPost-Exploitation Impact: Upon successful exploitation, an attacker is granted the same privilege level as an authenticated user. This permits the execution of administrative commands, unauthorized access to sensitive data, or the ability to perform operations that the framework intends to restrict to legitimate, authenticated sessions. The attack requires no prior credentials and can be automated, facilitating mass scanning and exploitation of public-facing instances of agno-agi.\nDue to the publicly available nature of the exploit code, the technical barrier to entry is minimal, allowing even unskilled actors to bypass security headers and perform unauthorized actions against affected application instances."
}