CVE-2026-108818: agno-agi agno auth.py get_authentication_dependency missing authentication
A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function getauthenticationdependency of the file auth.py. Such manipulation of the argument securitykey leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which releases are affected?
The issue affects agno-agi agno versions up to 2.7.3 and 3.0.6.
Can this be exploited remotely without an account?
Yes. The vulnerability is remotely reachable and the listed vector indicates that no privileges or user interaction are required.
What does an attacker need to manipulate?
Exploitation involves manipulating the security_key argument used by get_authentication_dependency in auth.py, causing authentication to be omitted.
Is public exploit code available?
Yes. A public exploit is available and may be used in attacks.
Is a vendor fix available?
The provided information does not identify a fix. It states that the project was notified through an issue report but had not responded at the time of publication.