CVE-2026-7466: AgentFlow RCE Vulnerability

CVE-2026-7466 Overview

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs and POST /api/runs/validate endpoints. This code injection vulnerability (CWE-94) enables attackers to induce requests to the local AgentFlow API to load and execute existing Python pipeline files on disk, resulting in code execution in the context of the user running AgentFlow.

Critical Impact
Attackers can achieve arbitrary code execution by manipulating the pipeline_path parameter, potentially leading to full system compromise with the privileges of the AgentFlow service user.

Affected Products

AgentFlow (all versions prior to the security patch)

Discovery Timeline

2026-04-29 - CVE-2026-7466 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7466

Vulnerability Analysis

This vulnerability stems from improper input validation in AgentFlow's API endpoints responsible for pipeline execution. The application fails to properly sanitize or validate the pipeline_path parameter submitted to the POST /api/runs and POST /api/runs/validate endpoints, allowing attackers to specify arbitrary file paths pointing to Python pipeline files on the local filesystem.

When exploited, the vulnerability allows an attacker to load and execute any Python pipeline file that exists on the target system. The code executes within the security context of the user account running the AgentFlow application, meaning an attacker could potentially gain the same level of access and permissions as the service account.

Root Cause

The root cause is classified as CWE-94 (Improper Control of Generation of Code), specifically relating to insufficient validation of user-supplied input in the pipeline_path parameter. The application trusts user input to specify which Python pipeline files should be loaded and executed without implementing proper path validation, allowlisting, or sandboxing mechanisms.

Attack Vector

The vulnerability is exploitable over the network, requiring an attacker to craft malicious HTTP POST requests to either the /api/runs or /api/runs/validate API endpoints. The attack requires some level of user interaction or prerequisites to be successful. An attacker would need to:

Identify a target AgentFlow instance accessible over the network
Craft a malicious POST request containing a manipulated pipeline_path parameter
Point the parameter to a Python pipeline file that exists on the target system
The file could be a pre-existing pipeline with malicious capabilities or a file placed by the attacker through another attack vector

The vulnerability allows loading of local Python files, enabling code execution when the pipeline is processed by the AgentFlow engine. For more technical details, refer to the VulnCheck Security Advisory.

Detection Methods for CVE-2026-7466

Indicators of Compromise

Unusual HTTP POST requests to /api/runs or /api/runs/validate endpoints containing unexpected pipeline_path values
API requests with pipeline_path parameters referencing paths outside the expected pipeline directory
Unexpected process spawning or file access from the AgentFlow service account
Log entries showing pipeline execution attempts with suspicious file paths

Detection Strategies

Monitor API logs for POST requests to /api/runs and /api/runs/validate with path traversal patterns (e.g., ../, absolute paths)
Implement web application firewall (WAF) rules to detect and block malicious pipeline_path parameter values
Deploy endpoint detection to alert on unusual Python script execution from the AgentFlow process context
Analyze network traffic for anomalous API request patterns targeting the vulnerable endpoints

Monitoring Recommendations

Enable detailed logging on AgentFlow API endpoints to capture all pipeline_path parameter values
Set up alerts for failed or suspicious pipeline execution attempts
Monitor file system access patterns from the AgentFlow service for unexpected Python file reads
Implement centralized log aggregation to correlate potential exploitation attempts across your environment

How to Mitigate CVE-2026-7466

Immediate Actions Required

Apply the security patch referenced in the GitHub Pull Request as soon as possible
Restrict network access to the AgentFlow API endpoints to trusted IP addresses only
Implement authentication and authorization controls on the vulnerable API endpoints if not already present
Review logs for any signs of prior exploitation attempts

Patch Information

A security patch is available via GitHub Pull Request #18. The specific code changes can be reviewed in the GitHub Changes Overview. Organizations should update to the patched version immediately to remediate this vulnerability.

Workarounds

Restrict network access to the AgentFlow API to trusted internal networks or localhost only using firewall rules
Implement a reverse proxy with strict input validation to filter malicious pipeline_path values before they reach the application
Run AgentFlow with minimal privileges using a dedicated service account with restricted file system access
Disable or remove the vulnerable endpoints if they are not required for your use case