EUVD-2026-97303
GHSA-h3xp-h9j5-qrcr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed AgentOS endpoint
-
ExploitObserve no security_key configured
-
ExecutionSend unauthenticated API request
-
ImpactInvoke agent operations without credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The AgentOS server must be deployed and network-reachable WITHOUT a security_key configured; in this default state get_authentication_dependency in auth.py applies no authentication, exposing agent endpoints to any remote caller (AV:N/PR:N/UI:N). The primary limiting factor is configuration: an operator who sets a security_key enables the authentication dependency and closes the exposure, so correctly-configured deployments are not affected. Realistic risk is therefore confined to instances left on default/no-key configuration and actually exposed to untrusted networks; as scored, impact is partial (VC:L/VI:L/VA:L) rather than full system takeover. |
| Impact | This is a medium-severity (CVSS 4.0 base 5.5), not a critical, issue despite the fully-remote unauthenticated vector (AV:N/AC:L/AT:N/PR:N/UI:N). The low rating is driven entirely by the limited impact metrics the reporter assigned - VC:L/VI:L/VA:L with no subsequent-system impact (SC/SI/SA:N) - meaning the flaw yields only partial confidentiality, integrity and availability loss rather than full system compromise. The CVSS vector carries E:P (Proof-of-Concept), which matches the input signal that exploit code is publicly available via a GitHub security advisory. It is NOT in CISA KEV, so there is no evidence of active exploitation. EPSS is not provided in the input, so real-world exploitation probability cannot be quantified from this data. The signals are internally consistent (network-reachable, no privileges, PoC exists), but note a likely scoring discrepancy worth flagging: a CWE-306 'missing authentication by default' on an agent-orchestration server would in many organizations grant full access to agent operations/data, which could justify higher impact metrics than the VC:L/VI:L/VA:L the reporter chose - verify actual exposed capabilities against your deployment. Net: a credible, easily-exploitable exposure for anyone running an internet-reachable Agno AgentOS without a configured security_key, but prioritized below critical given the as-scored low impact and absence of KEV/active-exploitation evidence. |
| Exploit ScenarioDerived | An Agno AgentOS instance is deployed and exposed to the network with no security_key configured, so get_authentication_dependency in auth.py imposes no authentication. A remote attacker who discovers the endpoint directly invokes agent API operations without any credentials. A public proof-of-concept/advisory already documents the default no-authentication behavior, lowering the barrier to exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Missing authentication in Agno (agno-agi) through version 2.7.3 and 3.0.6 causes AgentOS agent endpoints to be reachable by any remote caller when no security_key is configured, because get_authentication_dependency in auth.py applies no authentication check in that default state. Publicly available exploit code exists, and the project was notified through an upstream issue report but has not yet responded, so no vendor-released patch is identified at time of analysis. The flaw is configuration-dependent and is assessed as medium severity (CVSS 4.0 base 5.5, our independent CVSS:3.1 5.3-equivalent vector AV:N/AC:L/PR:N/UI:N with partial C:L/I:L/A:L impact) - deployments that set a security_key are not exposed, so unauthenticated remote access is confined to default-configured, network-reachable instances.
RemediationAI
No vendor-released patch identified at time of analysis; the project was informed of the problem early through the upstream issue report (https://github.com/Agno-agi/Agno/issues/10051) and has not responded, so no fixed version number can be cited. The most effective compensating control is to configure a strong, randomly generated security_key on every AgentOS deployment so that get_authentication_dependency actually enforces authentication - this is a configuration change with negligible runtime side effects but it must be applied consistently across all instances, since a single exposed node remains unauthenticated. Where a key cannot be set, place the AgentOS service behind an authenticating reverse proxy or API gateway (mTLS, OAuth/OIDC, or basic auth with TLS), accepting the added latency and the need to keep the gateway policy in sync with agent routes; alternatively bind the listener to localhost or to a management interface and enforce network policy/firewall rules that permit only trusted clients - a strict reduction in reachability that will break any intended remote or multi-tenant access. Because exploit code is publicly available, treat any internet-reachable, key-less AgentOS instance as compromised-capable and review its logs for unauthorized agent invocations; monitor the VulDB entry (https://vuldb.com/vuln/416595/cti) and the project repository for a patched release and re-verify the authentication dependency after upgrading to any version newer than 3.0.6.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is CWE-306 (Missing Authentication for Critical Function) in the Agno AgentOS Python framework. The affected function, get_authentication_dependency in auth.py, is the dependency hook that is meant to validate a security_key before allowing requests into agent functionality; when that key is absent or empty - the framework's shipped default - the dependency short-circuits and no credential check is enforced. The CPE entry cpe:2.3:a:agno-agi:agno:*:*:*:*:*:*:*:* uses a wildcard version, consistent with the VulDB report covering all releases up to 2.7.3 and 3.0.6; no per-version CPE granularity is provided. The publicly referenced exploit write-up is titled 'agno-agentos-no-authentication-by-default', confirming the root cause is a default-configuration design weakness rather than a memory-safety or injection bug. Because the failure mode is a missing guard rather than a bypass of an existing one, any remote caller reaching an unprotected AgentOS listener inherits whatever privileges the agent endpoints expose.
Know when Agno gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Missing-authentication-by-default is remotely reachable with no privileges or interaction (AV:N/AC:L/PR:N/UI:N); impact kept low (C:L/I:L/A:L) to match the reporter's partial-impact assessment, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependency of the file auth.py. Such manipulation of the argument security_key leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Model-influenced tool calls in the Agno agent framework (agno-agi) through 3.0.6 and 3.1.1 reach Python exec()/runpy()/s
Remote code execution in Agno prior to version 2.3.24 allows attackers to execute arbitrary Python code by manipulating
SQL injection in agno 2.6.5's ClickHouse vector database backend allows authenticated attackers to inject arbitrary SQL
OS command injection in the Agno agent framework's CodingTools.run_shell helper (versions up to and including 3.0.9) let
Agno's Team Delegation Feature runs member agents without a confirmation gate, allowing an actor who can influence deleg
Code injection in the PythonTools component of Agno (agno-agi/agno) through version 3.0.6 lets an attacker who can influ
Exploit-DB