agno-agi agno up to 2.7.3/3.0.6 auth.py get_authentication_dependency security_key missing authentication

Summaryinfo

A vulnerability marked as critical has been reported in agno-agi agno up to 2.7.3/3.0.6. This vulnerability affects the function get_authentication_dependency of the file auth.py. Performing a manipulation of the argument security_key results in missing authentication. This vulnerability is known as CVE-2026-108818. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Detailsinfo

A vulnerability, which was classified as critical, was found in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. The manipulation of the argument security_key with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-108818. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The project was informed of the problem early through an issue report but has not responded yet.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• agno-agi

Name

• agno

Version

• 2.7.0
• 2.7.1
• 2.7.2
• 2.7.3
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6

Website

• Product: https://github.com/Agno-agi/Agno/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #964162: Agno AGI Agno 2.7.3 CWE-306 Missing Authentication for Critical Function (by Ybyu)

Duplicate

• Submit #XXXXXX: Xxxx Xxx Xxxx X.x.x Xxx-xxx Xxxxxxx Xxxxxxxxxxxxxx (by Ybyu)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion