CVE-2026-108818: Agno AgentOS turns on no authentication by default, exposing sessions, config and agent runs to anyone who can reach it
Agno's AgentOS installs no authentication unless you set a security key or enable JWT authorization: with no OS_SECURITY_KEY, get_authentication_dependency() simply allows every request. Anyone who can reach a default AgentOS can read every session's history, list agent, team and workflow configuration, and start runs. NVD lists Agno up to 2.7.3 and 3.0.6; the report is still open, so set a key yourself.
What it is
In libs/agno/agno/os/auth.py, get_authentication_dependency() returns True (allow) whenever settings.os_security_key is not set, and the auth middleware is only installed when a key or JWT authorization is configured.
The reporter (agno-agi/agno#10051) shows that an unauthenticated caller then gets full read and write access to the REST API, including session histories, configuration and new agent, team and workflow runs. The /info endpoint reports auth_mode none.
VulDB scores it 5.5 (CVSS 4.0); the issue was still open on 11 November 2026 and the same fail-open check is still on main.
How to check
- Check whether your AgentOS deployment sets OS_SECURITY_KEY or enables JWT authorization.
- Call your AgentOS /info endpoint: if it reports auth_mode none, anyone who can reach it can use it.
How to fix
- Set a long random OS_SECURITY_KEY (or turn on JWT authorization) on every AgentOS that is reachable over a network.
- Keep AgentOS on localhost or a private network unless it has authentication in front of it.
export OS_SECURITY_KEY="$(openssl rand -hex 32)"
# clients then send: Authorization: Bearer $OS_SECURITY_KEY