Agno Race Condition Vulnerability Leading to Session State Overwrites

A race condition vulnerability has been identified in Agno versions 2.0.0 prior to 2.2.2. Under high concurrency, when 'session_state' is passed to Agent or Team during run or arun calls, the race condition can cause 'session_state' to be incorrectly assigned and persisted to the wrong session. This flaw may result in user data from one session being exposed to another user.

Impact

Exploitation of this vulnerability can lead to unauthorized access to user data across different sessions.

Remediation

Users can upgrade to Agno version 2.2.2 to address this vulnerability.