high7.1
CVE-2025-64168
Agno session state overwrites between different sessions/users
Impact
### Impact Under certain conditions (under high concurrency), when `session_state` is passed to an Agent or Team during run or arun calls, a race condition can occur, causing a `session_state` to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user. ### Patches This has been patched in version 2.2.2. Upgrade with `pip install -U agno`.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | agno | >= 2.0.0, < 2.2.2 | 2.2.2 |