CVE-2025-64168: Agno session state overwrites between different sessions/users

October 31, 2025

Under certain conditions (under high concurrency), when session_state is passed to an Agent or Team during run or arun calls, a race condition can occur, causing a session_state to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user.

References

github.com/advisories/GHSA-vw84-hprm-cxmm
github.com/agno-agi/agno
github.com/agno-agi/agno/security/advisories/GHSA-vw84-hprm-cxmm
nvd.nist.gov/vuln/detail/CVE-2025-64168

Code Behaviors & Features

Detect and mitigate CVE-2025-64168 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →