CVE-2026-10105: agno 2.6.5 SQL Injection via ClickHouse delete_by_metadata()

Synopsis

A SQL injection flaw in the agno AI agent framework lets an authenticated user smuggle arbitrary SQL through the ClickHouse vector backend's delete_by_metadata() method, which builds queries with unsafe f-string interpolation in clickhousedb.py. The bug is reachable over the network with any low-privilege account and no victim interaction, and successful exploitation lets an attacker delete arbitrary rows or exfiltrate data through error-based and blind SQL injection. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched rebuild available the moment a fixed version ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the agno service hosting the ClickHouse vector backend over the network (AV:N).

• AuthenticationRequired

  Any low-privilege account that can call delete_by_metadata() with attacker-controlled keys or values is sufficient (PR:L).

• Victim interactionNot required

  No user has to click, open, or approve anything for the injection to fire (UI:N).

• Attack complexityDetail

  Attack complexity is low: the f-string interpolation is reliably exploitable without race conditions or environmental tuning (AC:L).

Blast Radius

• Reads arbitrary rows from the ClickHouse vector store, including embeddings, source documents, and any metadata persisted alongside them, via error-based or blind SQL injection.
• Modifies or deletes rows in the vector store, up to and including wiping every row backing an agent's knowledge base.
• Causes partial availability loss for agents that depend on the corrupted or emptied vector collections.