Technical impact
The vulnerability is a SQL injection flaw in agno 2.6.5’s ClickHouse backend, where malicious metadata keys and values supplied to delete_by_metadata() are interpolated directly into SQL statements via an f‑string in clickhousedb.py. The flaw permits attackers to execute arbitrary SQL expressions, allowing them to delete every row, target specific rows, or glean database contents with error‑based or blind techniques. This is a CWE‑89 weakness that compromises confidentiality, integrity, and availability of the stored data.
Affected Systems
Only the agno product from the agno‑agi vendor is known to be affected, specifically version 2.6.5. No other versions or related products are listed. If a system is running agno 2.6.5 and uses the ClickHouse vector database backend, it is potentially vulnerable.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity vulnerability. EPSS data is not available, and the issue is not in CISA’s KEV catalog. The likely attack vector is through any interface that calls delete_by_metadata(), which can be invoked by users with privileges to submit metadata. An attacker who can supply the malicious payload can delete entire tables or exfiltrate sensitive data, making this an urgent risk for environments where agno’s ClickHouse integration is exposed to untrusted input.
Github GHSA