al-ice.ai

The Loop Runs Whatever the Model Asks: agno’s Fourth and Fifth CVEs

AI Vulnerabilities & CVEs by al-ice.ai Editorial

An hour after yesterday’s three-CVE agno batch, NVD published the rest of researcher ybyu-ieu’s 8 September findings. CVE-2026-108819 (7.3 on CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L; 5.5 on CVSS 4.0; CWE-913) names the agent orchestration layer itself: the function exec path executes every tool call the model requests immediately, with no deterministic policy gate and no human confirmation enabled by default. CVE-2026-108820 (6.3 / 2.1) — the record this site noted yesterday as in flight with no NVD entry — is now published: member_agent.run in the team delegation feature runs member agents with the leader’s identity and full toolset, unscoped and without confirmation. Both carry vulnStatus: Deferred, both credit the same reporter, and both fix PRs — written by the community, not the maintainers — sit open and unmerged.

The 108819 claim is checkable in one function, so we checked it. In libs/agno/agno/models/base.py, run_function_calls() at main HEAD iterates the model’s requested calls, and the only deterministic pauses in the loop are the per-tool opt-in flags: requires_confirmation (which shelves the call as a ToolExecution awaiting approval) and requires_user_input, plus the special-cased get_user_input control-flow tool. Everything else falls through to execution. The tool decorator declares requires_confirmation: Optional[bool] = None — documented as “If True, the function will require user confirmation before execution” — and the exclusivity check treats all three HITL flags as false unless set. Opt-in, off by default, exactly as issue #10053 (open since 8 September, self-scored 9.8 by the reporter) states. A coding agent whose every tool defaults to execute is an agent whose safety posture is whatever the tool author remembered to opt into.

Two PRs, zero merges, zero reviews

The remediation trail is the story’s second half. For 108819, community member Kylinny opened PR #10523 on 24 September — fix: require confirmation by default for PythonTools code-executing tools — pausing run_python_code, save_to_file_and_run, run_python_file_return_variable and the pip-install tools instead of executing a model-requested call. It has zero review comments and no merge. For 108820, PR #10124 (fix: require confirmation for team delegation, 11 September) likewise sits open and unmerged, while issue #10054 sits at zero comments. Contrast this with the same batch’s CodingTools fix, which went from PR to release v3.0.10 in under three hours on 16 September: the project can move fast on this class of bug when it chooses to. The confirmation-gate reports — the ones that change default behaviour rather than patch a sink — are the ones waiting.

The scoring incoherence we noted yesterday gets worse with the new pair inside the frame. The orchestration loop that runs arbitrary model-requested code with no gate carries 5.5 on CVSS 4.0 (PR:N, VC:L/VI:L/VA:L); the unauthenticated AgentOS endpoint from the same batch carries the same week’s higher number for a misconfiguration. And the researcher’s own 9.8 on #10053 versus the assigned 7.3/5.5 replays the calibration gap from yesterday’s batch: the people who found the sinks rate the loop that feeds them. Our position is unchanged — the loop finding is the batch’s most structural one, because every future tool agno ships inherits the default it sets.

What to do

  • Set requires_confirmation on every code-executing tool you register (run_python_code, shell tools, file writers, installers) — the default will not do it for you. Or gate at the run level with confirmation tooling; do not rely on the loop to pause.
  • Scope team delegation explicitly. Until #10124 or equivalent merges, member agents inherit the leader’s identity and toolset; restrict member toolsets and treat delegated runs as leader-privileged.
  • Watch PRs #10523 and #10124, not just releases. Both fixes exist as open community PRs; a merge is the event that changes your posture, and neither has one.
  • Track the remaining advisories. The researcher’s advisory repository holds seven entries; five now carry CVEs. Assume the batch is not finished.

Verification note. Both CVE identifiers, publication timestamps (12 October 2026, 10:16:43Z), CVSS 3.1 and 4.0 scores and vectors, CWE assignments, affected ranges (up to 3.0.6/3.1.1) and vulnStatus: Deferred were read first-hand from the NVD 2.0 API. Issue states, creation dates, authors, comment counts (#10053: open, 2 comments; #10054: open, 0 comments) and PR states (#10523 and #10124: open, unmerged) were read first-hand from the GitHub API. The loop analysis was verified first-hand against run_function_calls() in models/base.py at main HEAD and the requires_confirmation default in the tool decorator — quoted paraphrases only, no code reproduced beyond identifiers. agno was not installed, no tool was executed, no AgentOS instance started. The remedy-priority reading is our editorial analysis. We have no evidence of exploitation and imply none.

Sources: