High severity · published Oct 31, 2025
CVE-2025-64168
Agno session state overwrites between different sessions/users
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Agno is a multi-agent framework, runtime and control plane. From 2.0.0 to before 2.2.2, under high concurrency, when session_state is passed to Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. This has been patched in version 2.2.2.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
agno · agno-agi
>= 2.0.0, < 2.2.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64168
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64168
github.com
https://github.com/agno-agi/agno/security/advisories/GHSA-vw84-hprm-cxmm
More from agno
8.8
CVE-2026-76832
Agno PythonTools Path Traversal via joinpath file_name argument
8.3
CVE-2026-10105
agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()
8.1
CVE-2026-119050
Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection
7.3
CVE-2026-108819
agno-agi agno Agent Orchestration Layer exec dynamically-managed code resources
7.3
CVE-2026-108818
agno-agi agno auth.py get_authentication_dependency missing authentication