# CVE-2026-108819: agno-agi agno arbitrary code execution in Agent Orchestration Layer

Source: https://junglewise.ai/threats/cve-2026-108819-a-security-flaw-has-been-discovered-in-agno-agi-agno-up-to-3-0-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108819 · Severity: high · CVSS 7.3 · Published 2026-10-12

agno is an agent orchestration platform that manages AI-powered agent systems. A security flaw in the Agent Orchestration Layer allows malicious or compromised AI models to execute arbitrary Python code on the host system without any default confirmation gate. An attacker who can influence the model's output—such as through prompt injection on agents processing untrusted content—can force immediate code execution, leading to system compromise and data theft.

Technologies: [Agno-Agi Agno](https://junglewise.ai/threats/technologies/agno-agi-agno). Vendors: [Agno-Agi](https://junglewise.ai/threats/vendors/agno-agi).

## Quick answers

**Is CVE-2026-108819 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108819 being exploited in the wild.

**How severe is CVE-2026-108819?** High severity, with a CVSS score of 7.3, published 12 October 2026.

**Which products and versions are affected?** Agno-Agi Agno up to 3.0.6 and 3.1.1.

**Is there a fix for CVE-2026-108819?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108819 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-108819?** Check whether you run Agno-Agi Agno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insecure defaults issue (CWE-913) in the run_function_calls() method of the Agent Orchestration Layer. When a model requests a tool call (such as run_python_code), the code is executed immediately via exec() without requiring user confirmation by default. All confirmation gates (requires_confirmation, requires_user_input, ask_user, external_execution) are opt-in flags that default to off, and a log-only warning is the only default safeguard. Remote exploitation is possible if an attacker can influence the model's input through prompt injection or similar techniques targeting agents that process untrusted content.

## Affected products

- agno-agi agno up to 3.0.6 and 3.1.1

## Timeline

- 2026-10-12: disclosed: Vulnerability published in NVD
- 2026-09-08: other: Bug report filed on GitHub
- 2026-09-24: other: Pull request #10523 opened to fix the issue

## References

- [https://github.com/Agno-agi/Agno/](https://github.com/Agno-agi/Agno/)
- [https://github.com/Agno-agi/Agno/issues/10053](https://github.com/Agno-agi/Agno/issues/10053)

## Related threats

- [agno privilege escalation in team delegation feature](https://junglewise.ai/threats/cve-2026-108820-a-weakness-has-been-identified-in-agno-agi-agno-up-to-3-0-6-3-1)
- [agno authentication bypass in get_authentication_dependency](https://junglewise.ai/threats/cve-2026-108818-a-vulnerability-was-identified-in-agno-agi-agno-up-to-2-7-3-3-0)
- [agno CodingTools OS command injection in run_shell](https://junglewise.ai/threats/cve-2026-108817-a-vulnerability-was-determined-in-agno-agi-agno-up-to-3-0-9)
- [agno PythonTools code injection in run_python_code](https://junglewise.ai/threats/cve-2026-108816-a-vulnerability-was-found-in-agno-agi-agno-up-to-3-0-6-affected)