Agno CVE-2026-108820

Requires a deployment using agno's Team Delegation Feature (the delegate_task_to_member / delegate_task_to_members tooling) on affected versions up to 3.0.6/3.1.1, where member-agent execution lacks the requires_confirmation gate. An actor able to influence delegated task content - consistent with the PR:L low-privilege requirement in the CVSS vector - can cause member agents to run actions with unnecessary, unscoped privileges with no human confirmation step. Limiting factors: the team/delegation feature must actually be in use, low-privilege access or task-input influence is needed (not fully anonymous), and the real-world impact is bounded (Low confidentiality/integrity/availability, no subsequent-system scope change).

This is a moderate, defense-in-depth issue rather than a high-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 5.3, with all impacts rated Low (VC:L/VI:L/VA:L) and no scope/subsequent-system change (SC:N/SI:N/SA:N), which is consistent with CWE-250 (execution with unnecessary privileges) - the delegation feature runs member agents without a confirmation gate rather than granting an attacker direct code execution. Exploitation status is 'publicly available exploit code exists' (POC published via a GitHub security advisory and referenced by VulDB); there is NO CISA KEV listing and NO EPSS score in the input, so real-world exploitation frequency cannot be quantified and should not be assumed. PR:L means exploitation requires some low-privilege access/interaction with the team, not fully unauthenticated abuse. Note a data conflict: the input labels the patch 'Available from vendor,' but the description and the referenced pull request (#10124) indicate the fix 'awaits acceptance' - i.e., it is a pending PR, not a confirmed released version; verify the fix is merged/released before relying on it. Overall: a legitimate hardening fix worth applying, but the low impact metrics, PR:L requirement, and absence of KEV/EPSS signals make this a medium-at-most priority, not a critical one.

An attacker with low-privileged access to an agno Team (for example via crafted or prompt-injected task input) triggers the delegation feature so that a member agent is executed without any confirmation or scoping gate. Because member_agent.run proceeds automatically, the delegated action runs with the team's privileges, allowing unintended operations. A public proof-of-concept advisory demonstrating the unscoped/unconfirmed delegation is already available.