Description

A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function member_agent.run in the library libs/agno/agno/team/_default_tools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T10:16:43.783Z",
  "pubdate": "2026-10-12T10:16:43.783Z",
  "executiveSummary": "A privilege escalation vulnerability has been identified within the Delegation Feature of the agno-agi agno library, specifically affecting versions up to 3.0.6 and 3.1.1. The flaw resides in the member_agent.run function, which fails to properly enforce privilege boundaries during task delegation.\nThe vulnerability allows a remote attacker to execute arbitrary actions with elevated privileges that exceed the intended scope of the delegated agent. This represents a significant security risk, as the integrity and confidentiality of the agent-based system can be compromised by bypassing established permission models.\nExploitation of this vulnerability does not require complex local access, as the attack vector is exposed to remote manipulation. Publicly available exploit code increases the urgency of remediation. The issue currently awaits a formal pull request merge to resolve the logic flaw in the handling of agent delegation tasks.",
  "technicalDetails": "The vulnerability is situated in the libs/agno/agno/team/_default_tools.py file within the member_agent.run function, which is a core component of the agno framework's delegation architecture. The root cause is a failure in the authorization and scope validation logic when a delegated agent performs actions on behalf of the controller or the main system.\nSpecifically, the member_agent.run function processes incoming execution requests without sufficient verification of the caller's identity or the context-bound permissions assigned to the delegated agent. Because the system fails to verify that the delegated task remains within the restricted operational parameters, the agent can be manipulated into executing functions or accessing resources that require higher privilege levels than those originally granted to the sub-agent.\nThe attack flow begins when an attacker sends a crafted input or trigger to an endpoint that leverages the Delegation Feature. By manipulating the parameters passed to member_agent.run, the attacker influences the agent to initiate an unauthorized process execution or resource retrieval. Since the library handles these delegation calls in an elevated context, the member agent assumes the security posture of the parent process, effectively performing a confused deputy attack.\nThe exploitation is feasible remotely, allowing an external threat actor to issue commands through the affected interface. Once the member_agent.run function is triggered with the malicious payload, the system fails to perform the necessary privilege drops or context-switches, resulting in the execution of the payload with the effective permissions of the hosting agent environment.\nPost-exploitation impact is severe, as it allows for arbitrary action execution within the framework. An attacker may leverage this to extract sensitive data, modify system configurations, or interact with downstream services that the agent is permitted to communicate with, despite the agent itself not having explicit authorization for those specific requests."
}