CVE-2026-76832: Agno PythonTools Path Traversal Flaw

CVE-2026-76832 Overview

CVE-2026-76832 is a path traversal vulnerability [CWE-22] in Agno's PythonTools module located at libs/agno/agno/tools/python.py. Attackers can supply parent-directory traversal sequences in the file_name argument passed to read_file, save_to_file, or run_python_file tool actions. This allows arbitrary file read, arbitrary file write, or arbitrary Python code execution outside the intended base_dir boundary. Exploitation occurs through direct tool invocation or through prompt injection embedded in agent-processed content. The flaw affects AI agent deployments that expose these tools to untrusted input.

Critical Impact
Successful exploitation yields arbitrary file read, write, and Python code execution within the process user's authority, enabling full agent host compromise.

Affected Products

Agno agent framework — PythonTools in libs/agno/agno/tools/python.py
Agno MLXTranscribeTools component (also patched in the same fix)
Agent deployments exposing read_file, save_to_file, or run_python_file actions

Discovery Timeline

2026-08-19 - CVE-2026-76832 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76832

Vulnerability Analysis

The vulnerability stems from insufficient path validation in Agno's PythonTools module. The framework accepts a file_name argument in tool actions and joins it to a configured base_dir using Path.joinpath semantics. When file_name contains parent-directory traversal sequences such as ../../../../../../etc/passwd, the resulting path escapes the intended base directory.

Three tool actions are affected: read_file enables arbitrary file read, save_to_file enables arbitrary file write, and run_python_file enables arbitrary Python code execution. All operations execute with the authority of the process user running the agent. Exploitation is not limited to direct API callers — an attacker can inject traversal payloads through prompt injection in any content the agent ingests, including web pages, documents, or tool outputs.

Root Cause

The root cause is missing containment enforcement after path resolution. The pre-patch code resolved base_dir but did not verify that a joined file_name remained within that resolved directory. Because pathlib.Path.joinpath treats absolute paths and traversal sequences literally, any file_name containing .. segments produces a path outside base_dir without triggering an error.

Attack Vector

An attacker with the ability to influence tool arguments — either directly or through agent-processed content — supplies a file_name value containing traversal sequences. The agent executes the requested action against the resolved path. Prompt-injection payloads embedded in third-party content can trigger the same tool calls without direct attacker access to the API.

python

# Security patch from libs/agno/agno/tools/file.py
# Introduces resolve() to canonicalize base_dir; the full fix
# adds a restrict_to_base_dir parameter to PythonTools and
# MLXTranscribeTools that enforces containment on joined paths.
        all: bool = False,
        **kwargs,
    ):
-        self.base_dir: Path = base_dir or Path.cwd()
-        self.base_dir = self.base_dir.resolve()
+        self.base_dir: Path = (base_dir or Path.cwd()).resolve()

        tools: List[Any] = []
        self.max_file_length = max_file_length

Source: GitHub Commit 710d7e7

Detection Methods for CVE-2026-76832

Indicators of Compromise

Tool invocation logs containing .. sequences or absolute paths in the file_name argument to read_file, save_to_file, or run_python_file.
Agent process reads or writes to sensitive paths outside the configured base_dir, such as /etc/passwd, ~/.ssh/, or cloud credential files.
Unexpected Python files written to system directories followed by execution by the agent process user.

Detection Strategies

Instrument Agno tool calls to log the raw file_name argument and the resolved absolute path before file operations.
Alert on any resolved path that does not have base_dir as a prefix after canonicalization.
Inspect prompt content and retrieved documents for traversal patterns targeting known sensitive files.

Monitoring Recommendations

Monitor filesystem access by the agent process user for reads or writes outside expected working directories.
Correlate agent tool-invocation telemetry with subsequent process creation events to identify code execution via run_python_file.
Review agent conversation logs for prompt-injection markers accompanied by file-tool invocations.

How to Mitigate CVE-2026-76832

Immediate Actions Required

Upgrade Agno to a version that includes commit 710d7e7f846f93b7a3eadfd3e77075428c39e803 and enable the new restrict_to_base_dir parameter on PythonTools and MLXTranscribeTools.
Run agent processes as an unprivileged user with filesystem access limited to the intended working directory.
Audit existing agent deployments for exposure of read_file, save_to_file, and run_python_file to untrusted input.

Patch Information

The upstream fix is delivered in GitHub Commit 710d7e7, which adds a restrict_to_base_dir parameter to PythonTools and MLXTranscribeTools and canonicalizes base_dir via Path.resolve(). Additional context is available in the VulnCheck Security Advisory and the Agno project repository.

Workarounds

Wrap tool calls with a validator that rejects any file_name containing .., absolute paths, or symlinks pointing outside base_dir.
Sandbox the agent process using OS-level controls such as containers, seccomp, or AppArmor to limit filesystem reach.
Disable run_python_file, save_to_file, and read_file tools in agents that process untrusted content until the patch is applied.

bash

# Configuration example - enforce base directory restriction
from pathlib import Path
from agno.tools.python import PythonTools

tools = PythonTools(
    base_dir=Path("/opt/agent/workspace").resolve(),
    restrict_to_base_dir=True,
)