HIGH7.1
PYSEC-2026-1077
Agno session state overwrites between different sessions/users
Quick fix
PYSEC-2026-1077 — agno: upgrade to the fixed version with the command below.
pip install --upgrade 'agno>=2.2.2'Details
### Impact Under certain conditions (under high concurrency), when `session_state` is passed to an Agent or Team during run or arun calls, a race condition can occur, causing a `session_state` to be assigned and persisted to the incorrect session. This may result in user data from one session being exposed to another user.
### Patches This has been patched in version 2.2.2. Upgrade with `pip install -U agno`.
Are you affected?
Enter the version of the package you're using.