PT-2025-44638 · Agno · Agno

Published 2025-10-31 · Updated 2025-11-04 · CVE-2025-64168

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Agno versions 2.0.0 through 2.2.1

Description Agno is a multi-agent framework, runtime, and control plane. Under high concurrency, a race condition can occur when session state is passed to Agent or Team during run or arun calls. This can lead to a session state being assigned and persisted to the incorrect session, potentially exposing user data from one session to another user.

Recommendations Update to version 2.2.2 or later.

Exploit

Fix

Race Condition

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-362

CWE-668

Related Identifiers

CVE-2025-64168

GHSA-VW84-HPRM-CXMM

Affected Products

Agno

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64168.json · Exploit
• https://osv.dev/vulnerability/GHSA-vw84-hprm-cxmm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64168 · Security Note
• https://github.com/agno-agi/agno · Note
• https://github.com/agno-agi/agno/security/advisories/GHSA-vw84-hprm-cxmm · Note
• https://t.me/CVEtracker/36309 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1oo83gr/resumen_diario_de_vulnerabilidades_04112025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1984344566275711394 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1onduhn/resumen_diario_de_vulnerabilidades_03112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ono2et/resumen_diario_de_vulnerabilidades_03112025 · Reddit Post
• https://twitter.com/CVEnew/status/1984277947453440200 · Twitter Post
• https://t.me/cveNotify/141151 · Telegram Post