CVE-2026-10105: SQL Injection in Agno 2.6.5 ClickHouse Backend

Technical summary

The vulnerability stems from unsafe f-string interpolation in clickhousedb.py within agno 2.6.5's ClickHouse backend. The delete_by_metadata() method fails to sanitize user-supplied metadata keys and values before embedding them directly into SQL queries. An authenticated attacker can leverage CWE-89 (SQL injection) to inject arbitrary SQL expressions, enabling attack vectors including but not limited to: mass deletion of rows, targeted row deletion, error-based information extraction, and blind SQL injection for data exfiltration. The vulnerability is particularly dangerous in deployments where agno manages sensitive vector data or metadata indices.

Business impact

Exploitation could result in unauthorized data deletion, loss of critical vector embeddings or associated metadata, or extraction of confidential information stored in the ClickHouse backend. For organizations using agno in production AI/ML pipelines or semantic search systems, an insider or compromised account could disrupt data integrity, cause service unavailability, or breach data confidentiality. Recovery from mass deletion may require database restoration from backups, incurring operational downtime and potential data loss. The confidentiality and integrity impacts are rated high, making this a material risk for security-conscious deployments.

Affected systems

Agno version 2.6.5 is affected. Organizations running agno with a ClickHouse backend should assess their deployment. The vulnerability is not exploitable without valid authentication credentials, so risk is limited to insider threats, compromised service accounts, or lateral movement scenarios within a network where agno is accessible. Earlier or later versions of agno have not been specified in available advisories; verify your version and check vendor release notes for patched builds.

Exploitability

Exploitability is moderate to high given that an authenticated user is required. An attacker cannot exploit this vulnerability remotely without valid credentials (PR:L in the CVSS vector indicates low privilege requirement post-authentication). However, the attack complexity is low (AC:L), meaning that once authenticated, crafting a malicious payload requires minimal effort—straightforward SQL injection syntax. No user interaction or code execution is needed beyond a single API call. In environments with weak credential hygiene or shared service accounts, the practical exploitability increases significantly.

Remediation

Immediate remediation requires upgrading agno to a patched version released after 2.6.5. Verify the vendor advisory at agno's official repository or security page for the recommended release. In the interim, implement network segmentation and access controls to limit who can authenticate to agno instances. Restrict delete_by_metadata() API access through application-layer authorization checks. Ensure ClickHouse backends are network-isolated and that database credentials are not shared across multiple services.

Patch guidance

Check the agno project's official GitHub releases page or security advisories for a version newer than 2.6.5 that addresses this SQL injection. Apply the patch in a staging environment first to validate compatibility with your AI/ML pipeline and ClickHouse schema. Verify that vector data and metadata queries continue to function correctly post-patching. Consider scheduling the upgrade during a maintenance window to minimize service disruption. If a patched version is not yet available, consult the vendor's security advisory for temporary mitigation recommendations.

Detection guidance

Monitor ClickHouse query logs for suspicious SQL patterns in metadata-related delete operations—particularly those containing SQL keywords, special characters, or unexpected operators within metadata key and value fields. Implement alerting on failed or successful delete_by_metadata() calls that target unexpectedly large row counts or exhibit error-based SQL injection markers (e.g., UNION, CASE, or subquery keywords in metadata values). Enable audit logging on agno API endpoints to capture the identity and timestamp of callers invoking delete_by_metadata(). Review authentication logs for unusual account access or privilege escalation preceding any unusual database deletions.

Why prioritize this

Despite a CVSS score of 8.3 (HIGH), this vulnerability warrants high prioritization because it directly threatens data integrity and confidentiality in AI/ML systems where vector databases are mission-critical. The combination of high confidentiality and integrity impact, low attack complexity, and the widespread use of ClickHouse for semantic search and RAG systems means that exploitation could have cascading effects on dependent applications. Even though it requires authentication, insider threats and credential compromise are common in practice. Organizations should prioritize patching or implementing compensating controls within weeks, not months.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects: network-accessible attack surface (AV:N), low attack complexity once authenticated (AC:L), requirement for valid credentials (PR:L), no user interaction needed (UI:N), unscoped impact (S:U), high confidentiality loss (C:H), high integrity impact (I:H), and low availability impact (A:L). The high score is justified by the severity of potential data loss and information disclosure. However, the authentication prerequisite prevents a score in the critical range, making this HIGH rather than CRITICAL. Organizations should treat this as a material security debt requiring prompt remediation.

Frequently asked questions