Race Condition in Agno Multi-Agent Framework Exposes User Data
CVE-2025-64168

7.1HIGH

Key Information:

Vendor

Agno-agi

Status
Agno
Vendor
CVE Published:
31 October 2025

What is CVE-2025-64168?

The Agno multi-agent framework is susceptible to a race condition that can occur under high concurrency scenarios. This vulnerability arises when session_state is improperly assigned during Agent or Team run calls. If exploited, it may allow user data from one session to be wrongly assigned and persisted to another session, potentially exposing sensitive user information to unauthorized users. The issue has been resolved in version 2.2.2 of the framework.

Affected Version(s)

agno >= 2.0.0, < 2.2.2

References

https://github.com/agno-agi/agno/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64168 : Race Condition in Agno Multi-Agent Framework Exposes User Data