CVE-2026-10105

Name of the Vulnerable Software and Affected Versions agno version 2.6.5

Description A SQL injection issue exists in the ClickHouse vector database backend. Attackers can inject arbitrary SQL expressions by providing malicious metadata keys and values to the delete by metadata() function. This is possible due to unsafe f-string interpolation within the clickhousedb.py file, which could allow the deletion of all rows, targeting of specific rows, or information extraction using blind or error-based SQL injection techniques.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.