{"id":"CVE-2026-7439","title":"AgentFlow Local Web API Content-Type Validation Bypass","summary":"AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operatio…","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-346"],"vendor":"berabuddies","product":"AgentFlow","affected":["AgentFlow < 1667fa3"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-04-29T19:29:53.577095Z"},"exploitAvailable":true,"published":"2026-04-29","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:08:48.430Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-7439","references":[{"url":"https://github.com/berabuddies/agentflow/pull/18"},{"url":"https://github.com/berabuddies/agentflow/commit/1667fa3"},{"url":"https://www.vulncheck.com/advisories/agentflow-local-web-api-content-type-validation-bypass"}],"tags":["cve.org","exploit-available"],"epss":0.00089,"epssPercentile":0.00372,"ingestedAt":"2026-11-08T14:51:22.257Z","slug":"CVE-2026-7439","body":"## Overview\n\nAgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation weakness through browser-driven or local cross-origin requests to abuse the localhost API and enable attack chains against the local control plane.\n\n## Affected\n\n- `AgentFlow < 1667fa3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}