LLM frameworks · Agno (open source)
Agno
Open-source Python framework for building AI agents and multi-agent teams with built-in tools, memory and knowledge.
2Advisories
0critical
1high
1medium
2026-10-29Latest
Timeline · advisories per quarter
22026 Q4
Named in sources
Reported for Agno
01. CVE-2026-119050: Agno PandasTools lets a prompt-injected agent call any pandas function, including read_pickle for code execution, still unfixedAgno's PandasTools toolkit calls getattr on pandas with whatever function name the model chooses, so prompt injection can make an agent call read_pickle (which runs code when it loads a malicious pickle) or read local files. NVD lists Agno through 3.1.11 as affected, and the GitHub issue is still open with no fixed release, so turn these tools off for agents that see untrusted content. Agno 2026-10-29 02. CVE-2026-108818: Agno AgentOS turns on no authentication by default, exposing sessions, config and agent runs to anyone who can reach itAgno's AgentOS installs no authentication unless you set a security key or enable JWT authorization: with no OS_SECURITY_KEY, get_authentication_dependency() simply allows every request. Anyone who can reach a default AgentOS can read every session's history, list agent, team and workflow configuration, and start runs. NVD lists Agno up to 2.7.3 and 3.0.6; the report is still open, so set a key yourself. Agno 2026-10-12
Agno 2026-10-29 02. CVE-2026-108818: Agno AgentOS turns on no authentication by default, exposing sessions, config and agent runs to anyone who can reach itAgno's AgentOS installs no authentication unless you set a security key or enable JWT authorization: with no OS_SECURITY_KEY, get_authentication_dependency() simply allows every request. Anyone who can reach a default AgentOS can read every session's history, list agent, team and workflow configuration, and start runs. NVD lists Agno up to 2.7.3 and 3.0.6; the report is still open, so set a key yourself. Agno 2026-10-12