CVE-2026-7439: AgentFlow Authentication Bypass Vulnerability

CVE-2026-7439 Overview

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation weakness through browser-driven or local cross-origin requests to abuse the localhost API and enable attack chains against the local control plane.

Critical Impact
This vulnerability enables attackers to bypass content-type trust boundaries and abuse localhost API endpoints, potentially leading to unauthorized pipeline execution and local control plane compromise.

Affected Products

AgentFlow (local web API component)

Discovery Timeline

2026-04-29 - CVE CVE-2026-7439 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7439

Vulnerability Analysis

This vulnerability stems from improper validation of HTTP Content-Type headers in AgentFlow's local web API. The affected endpoints (POST /api/runs and POST /api/runs/validate) fail to enforce that incoming requests contain the application/json content type, which represents a trust-boundary enforcement weakness classified as CWE-346 (Origin Validation Error).

The lack of content-type validation creates an opportunity for attackers to craft malicious requests that bypass same-origin policy protections typically enforced by browsers. Since the API runs on localhost, it may be accessible through browser-based attacks where the attacker tricks a victim into visiting a malicious page that issues requests to the local AgentFlow API.

Root Cause

The root cause is the absence of content-type validation logic in the API request handling pipeline. The endpoints accept and process requests regardless of the Content-Type header value, allowing attackers to submit requests with alternative content types (such as text/plain or application/x-www-form-urlencoded) that browsers handle differently with respect to CORS preflight requirements.

Attack Vector

The attack requires local access and user interaction. An attacker can exploit this vulnerability through browser-driven cross-origin requests by:

Hosting a malicious webpage that contains JavaScript code targeting the victim's localhost AgentFlow API
Enticing the victim to visit the malicious page while AgentFlow is running locally
Issuing requests with non-JSON content types that bypass browser CORS preflight checks
Executing unauthorized pipeline operations through the unprotected API endpoints

python

# Security patch from agentflow/app.py - fix: harden web API pipeline loading by default (#18)
 _TERMINAL_RUN_STATUSES = {"completed", "failed", "cancelled"}
 
 
+def _api_pipeline_path_enabled() -> bool:
+    return os.getenv("AGENTFLOW_API_ALLOW_PIPELINE_PATH", "").strip().lower() in {"1", "true", "yes", "on"}
+
+
+def _require_json_request(request: Request) -> None:
+    content_type = request.headers.get("content-type", "")
+    if "application/json" not in content_type.lower():
+        raise HTTPException(status_code=415, detail="application/json content type required")
+
+
 @lru_cache(maxsize=1)
 def _load_default_web_example() -> str:
     example_path = bundled_template_path("pipeline")

Source: GitHub Commit for Agentflow

Detection Methods for CVE-2026-7439

Indicators of Compromise

HTTP requests to /api/runs or /api/runs/validate endpoints with Content-Type headers other than application/json
Unusual cross-origin requests targeting localhost AgentFlow API endpoints
Multiple failed or unexpected pipeline execution attempts originating from browser processes

Detection Strategies

Monitor web server logs for POST requests to sensitive API endpoints with non-standard Content-Type headers
Implement web application firewall (WAF) rules to flag requests lacking proper application/json content type
Review access logs for requests originating from unexpected referer headers indicating potential cross-origin abuse

Monitoring Recommendations

Enable verbose logging on the AgentFlow local web API to capture all incoming request headers
Set up alerts for HTTP 415 errors after patching to identify potential exploitation attempts
Monitor for unusual localhost network activity from browser processes

How to Mitigate CVE-2026-7439

Immediate Actions Required

Update AgentFlow to the patched version containing commit 1667fa3
Review API access logs for any suspicious requests with non-JSON content types
Restrict access to the local web API to only trusted local processes if possible

Patch Information

The security fix is available in GitHub Pull Request #18 and implemented in commit 1667fa3. The patch adds the _require_json_request() function that validates the Content-Type header and returns HTTP 415 (Unsupported Media Type) for requests that do not include application/json. For additional details, refer to the VulnCheck Advisory on Agentflow.

Workarounds

Disable the AgentFlow local web API if not actively required
Implement network-level firewall rules to restrict localhost API access
Set the AGENTFLOW_API_ALLOW_PIPELINE_PATH environment variable appropriately to limit pipeline path loading functionality

bash

# Configuration example - Restrict pipeline path loading
export AGENTFLOW_API_ALLOW_PIPELINE_PATH="false"