Agno session state overwrites between different sessions/users
Priority LOW 30CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. This has been patched in version 2.2.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix Fixed agno (agno-agi): 2.2.2agno (PyPI): 2.2.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| agno-agi | agno | 2.0.0 to before 2.2.2 | 2.2.2 | Patch available | CNA |
| — | agno (PyPI) | 2.0.0 to before 2.2.2 | 2.2.2 | Patch available | GHSA-vw84-hprm-cxmm |
- agno Vendoragno-agi Affected 2.0.0 to before 2.2.2 Fixed in 2.2.2 Patch available CNA
- agno (PyPI) Vendor— Affected 2.0.0 to before 2.2.2 Fixed in 2.2.2 Patch available GHSA-vw84-hprm-cxmm
Remediation
- Fix · CNA agno (agno-agi) Fixed in 2.2.2
- Fix · GHSA-vw84-hprm-cxmm agno (PyPI) Fixed in 2.2.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-64168
- 2026-10-03 Alias added: GHSA-vw84-hprm-cxmm
References
More agno-agi vulnerabilities
- TI-2026-82408 Code execution in Agno via unsafe reflection in PandasTools CVSS 4.0CRITICAL 9.2
- TI-2026-08858 agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata() CVSS 4.0HIGH 8.7
- TI-2026-70914 Improper control of dynamic code resources in agno-agi agno exec CVSS 4.0MEDIUM 6.9
- TI-2026-70913 Missing authentication in agno-agi agno get_authentication_dependency CVSS 4.0MEDIUM 6.9
- TI-2026-70915 Execution with unnecessary privileges in agno delegation feature CVSS 4.0MEDIUM 5.3
- TI-2026-70908 Code injection in agno-agi agno PythonTools CVSS 4.0MEDIUM 5.3
Sources
- CVE-2025-64168 · CVE Program
- CVE-2025-64168 · NVD
- FIRST EPSS
- GHSA-vw84-hprm-cxmm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences