What happened
VulnCheck published an advisory on October 29, 2026 for CVE-2026-119050, affecting the Agno agent framework through version 3.1.11. The advisory rates the issue critical, with a CVSS 4.0 score of 9.2, and classifies it as CWE-470: use of externally controlled input to select classes or code, commonly called unsafe reflection.
The affected component is PandasTools, an Agno tool integration for pandas. According to the advisory, it accepts a function name controlled by the model and passes that name to getattr() on the pandas module. That is a broad dispatch mechanism: rather than exposing a deliberately bounded set of operations, the integration can resolve arbitrary pandas functions named by the model.
The practical attack path begins with prompt injection. If an agent can read attacker-controlled material, injected instructions can attempt to make the model select a dangerous available function. VulnCheck specifically identifies pandas.read_pickle with an attacker-controlled path. Pickle deserialization is unsafe for untrusted data, so reaching that function can result in code execution. The advisory also says other reader functions could be used to read local files.
The CVSS vector records network reachability, no required privileges, and no user interaction, while also recording high attack complexity and a required attack condition. Those qualifiers matter: the advisory does not establish that every Agno deployment is automatically exploitable. It identifies a dangerous capability path when PandasTools is present and a model can be induced to make the relevant call.
VulnCheck lists Agno's repository and the relevant PandasTools source locations as references. The supplied reporting says an allowlist fix proposal existed but was still open, and that the October 29 Agno 3.1.12 release did not list a security change. Teams using the affected integration should therefore not assume that moving beyond 3.1.11 alone resolves the issue without checking the actual implementation and release notes.
What the archive adds
This is a new fact on a known security theme, not a continuation of the same vulnerability. Earlier coverage documented an unauthenticated Brotli decoder RCE and CISA's PHP patching guidance. Those were software flaws in dependencies and runtimes; this case is about an agent tool's model-directed capability boundary.
Trend signal
This directly supports Agent security moves to runtime boundaries. The failure is not merely that a model follows malicious text. The dangerous result comes from what the runtime permits after that text changes the model's chosen tool argument: a model-selected symbol is resolved against a broad library namespace. Prompt guardrails cannot make that dispatch boundary dependable; an explicit runtime allowlist can.
Why now
The advisory arrives as agent frameworks increasingly let models operate tools against documents, tickets, web pages, and data sources. In that setting, prompt injection is no longer only a text-quality problem. It can influence concrete function selection and file access. The disclosed path is timely because it makes the transition from injected instruction to executable capability unusually legible.
Why it matters
For teams building agents, the important design question is not whether a tool description tells a model to behave safely. It is whether the underlying tool exposes only the operations, arguments, paths, and permissions that the task requires. A convenience wrapper around a large Python module can silently create a much larger authority surface than its product name suggests.
This also changes review priorities. Security review should inspect dynamic dispatch, reflection, deserialization, filesystem readers, and network-capable helpers in every tool an agent can invoke. A model output that looks like a harmless function name is still untrusted input when it controls which implementation runs. The safer unit is a narrow task API with schema validation and an allowlist, not general access to a package namespace.
What happens next
- Agno users will audit or disable PandasTools where agents process untrusted content. (3 months, 70%). Watch for: an upstream advisory, release note, or documented mitigation.
- More agent-tool reviews will focus on reflection and model-controlled dispatch. (6 months, 65%). Watch for: framework guidance requiring allowlisted tool operations.
Limits and uncertainty
The advisory establishes the affected version range, the unsafe getattr() pattern, and the described route to read_pickle or local-file readers. It does not provide a public exploit demonstration in the supplied material, a list of known exploited deployments, or a count of users affected. It also does not establish which application configurations expose attacker-controlled content to a capable Agno agent. The reported status of a proposed allowlist fix should be verified against current upstream code and releases before teams make upgrade decisions.
Skill to build now
This week, inventory agent tools that turn model-generated strings into function names, methods, commands, paths, URLs, or imports. For each one, replace open-ended dispatch with a small explicit mapping of supported operations. Validate parameters per operation, reject unknown names, and block deserializers such as pickle readers for untrusted inputs. Then test the boundary with a malicious document or webpage whose only goal is to make the agent request a disallowed operation.
Reader takeaway
CVE-2026-119050 is a compact example of why agent security belongs at the tool boundary. If a model can choose any function in a broad library, prompt injection can become execution or data access. Give agents named, allowlisted capabilities rather than reflective access to a module.
Open question
Will Agno ship and document an allowlist-based remediation, and will it clarify whether other tool integrations accept model-controlled names or paths in comparable ways?