Is CVE-2026-108820 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108820 being exploited in the wild.

How severe is CVE-2026-108820?

Medium severity, with a CVSS score of 6.3, published 12 October 2026.

Which products and versions are affected?

Agno-Agi Agno up to 3.0.6 and 3.1.1.

Is there a fix for CVE-2026-108820?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-108820 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108820?

Check whether you run Agno-Agi Agno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108820: agno privilege escalation in team delegation feature

CVE-2026-108820 · Severity: medium · CVSS 6.3 · Published 2026-10-12

Agno is an AI agent framework for building and managing multi-agent systems. A privilege escalation vulnerability in the team delegation feature allows a member agent to inherit the leader's identity and access all of the leader's tools without scope restrictions or confirmation, enabling an attacker to perform unauthorized operations if they can influence the leader's context.

Technologies: Agno-Agi Agno. Vendors: Agno-Agi.

Quick answers

Is CVE-2026-108820 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108820 being exploited in the wild.
How severe is CVE-2026-108820?: Medium severity, with a CVSS score of 6.3, published 12 October 2026.
Which products and versions are affected?: Agno-Agi Agno up to 3.0.6 and 3.1.1.
Is there a fix for CVE-2026-108820?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-108820 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108820?: Check whether you run Agno-Agi Agno at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the member_agent.run() function in libs/agno/agno/team/_default_tools.py, where delegated tasks are executed with the leader's user_id, session, session_state, and full dependencies without tool filtering or scope restrictions (CWE-250). The delegate_task_to_member tool is registered without requiring user confirmation and performs no tool-level scoping during task assembly. An attacker can exploit this via prompt injection or other context manipulation to drive a member agent with dangerous tools (file write, shell, code execution) to execute arbitrary operations under the leader's identity.

Affected products

agno-agi agno up to 3.0.6 and 3.1.1

Timeline

2026-09-08: disclosed: Security vulnerability reported on GitHub issue #10054
2026-10-12: advisory: CVE-2026-108820 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.