Description

A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent Orchestration Layer. Performing a manipulation of the argument code results in dynamically-managed code resources. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-10-12T10:16:43.393Z",
  "pubdate": "2026-10-12T10:16:43.393Z",
  "executiveSummary": "A critical security vulnerability has been identified in the Agent Orchestration Layer of the Agno product, specifically within the 'exec' function.\nThis vulnerability is classified as Remote Code Execution (RCE), allowing an unauthenticated remote attacker to execute arbitrary code within the orchestration environment.\nThe flaw affects all Agno versions up to and including 3.0.6 and 3.1.1.\nThe risk is categorized as high due to the potential for full system compromise, unauthorized data access, and lateral movement within the infrastructure.\nPublic exploit code is currently available, significantly increasing the probability of active exploitation.\nThe vulnerability stems from improper sanitization or validation of input parameters passed to the orchestration engine, enabling attackers to manipulate dynamically-managed code resources.\nImmediate intervention is required as the official patch is currently pending review, leaving systems exposed to potential attack vectors.",
  "technicalDetails": "The vulnerability resides within the Agent Orchestration Layer component of the Agno framework, specifically targeting the 'exec' function responsible for handling and executing dynamically-managed code blocks.\nThe root cause is a failure in the input validation and sandboxing mechanism, which allows an attacker to supply malicious input via the 'code' argument. When the 'exec' function processes this input, it fails to sufficiently restrict the execution context, enabling the injection and subsequent execution of unauthorized code.\nThe attack flow initiates when a remote actor sends a crafted payload directed at the orchestration API or interface that utilizes the vulnerable 'exec' function. By manipulating the 'code' parameter, an attacker can bypass intended execution restrictions.\nBecause the vulnerability exists in the orchestration layer, the injected payload is executed with the privileges of the Agno service. This permits the attacker to interact with the underlying host system, access local files, retrieve sensitive credentials stored in environment variables, or initiate outbound network connections to command-and-control infrastructure.\nThe flaw is exacerbated by the design of the orchestration layer, which relies on dynamic code evaluation to perform its functions. The lack of strict control over the code execution boundary turns this feature into a powerful attack vector for Remote Code Execution (RCE).\nAffected versions are strictly defined as all versions up to 3.0.6 and 3.1.1. No authentication is inherently required to reach the vulnerable function if the orchestration endpoint is exposed to the network, and the exploitability is high given that the attack methodology has been released to the public domain.\nPost-exploitation impact is severe, as the attacker effectively gains control over the orchestration logic, allowing for the subversion of agent behaviors, data exfiltration, and persistent access to the server hosting the Agno orchestration layer."
}