CVE-2026-10105
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A SQL injection vulnerability was found in agno library version 2.6.5 in the ClickHouse vector database backend. The flaw exists in the delete_by_metadata() method in clickhousedb.py, which unsafely interpolates metadata keys and values into SQL queries. An attacker can inject arbitrary SQL expressions, allowing deletion of all rows, targeting specific rows, or extracting information through error-based or blind SQL injection.
Risk Assessment
The risk to the organization includes potential complete deletion of data from the ClickHouse database, unauthorized access to sensitive information, and possible data integrity loss. The attack can be performed remotely without authentication, increasing its criticality.
Recommendation
Immediately update the agno library to version 2.6.6 or later, which contains a fix for the vulnerability. Until the update is applied, restrict access to the delete_by_metadata() method and validate all input data passed as metadata.
Other vulnerabilities in agno
See all- CVE-2026-35002Critical
Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.
- CVE-2026-37003Low risk· EPSS 46%
Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.
- CVE-2026-76832High
PythonTools in Agno (libs/agno/agno/tools/python.py) contains a path traversal vulnerability that allows attackers to read, write, or execute arbitrary files by supplying parent-directory traversal sequences in the file_name argument to read_file, save_to_file, or run_python_file actions. The attack can be performed via direct tool invocation or via prompt injection in agent-processed content.
Original NVD description (English source)
agno 2.6.5 contains a SQL injection vulnerability in the ClickHouse vector database backend that allows attackers to inject arbitrary SQL expressions by supplying malicious metadata keys and values to the delete_by_metadata() method. Attackers can exploit the unsafe f-string interpolation in clickhousedb.py to delete all rows, target specific rows, or extract information through error-based or blind SQL injection techniques.