AgentFlow CVE-2026-7439

Requires the victim to have AgentFlow installed and actively running agentflow serve, binding the API to 127.0.0.1:8000 - the default serving mode. The attacker must cause the victim to visit a malicious web page in a browser on the same machine while AgentFlow is serving. The API is bound to loopback only, so the attack is not reachable by external network actors without the victim's browser as the delivery mechanism. The CVSS 4.0 PR:N metric confirms no attacker authentication is needed against the localhost API itself. Exploitation is non-automatable (SSVC) and requires passive user interaction. Impact is further bounded by the pipeline_path default-off behavior introduced in the fix: in unpatched versions where pipeline_path was not explicitly restricted, the attack chain could extend to loading arbitrary local Python files. In patched deployments without AGENTFLOW_API_ALLOW_PIPELINE_PATH=1, pipeline_path requests are rejected with HTTP 403 regardless of content-type enforcement.

The CVSS 4.0 score of 4.8 (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N) reflects that the vulnerable API is locally bound to 127.0.0.1 and exploitation requires the victim to interact with a browser (UI:P). The EPSS of 0.01% at the 0th percentile indicates near-zero observed exploitation probability, consistent with the tool's niche footprint. SSVC signals a PoC with non-automatable exploitation and partial technical impact - meaning mass scanning campaigns are not realistic but targeted abuse against a developer's workstation is plausible. No CISA KEV listing exists. The gap between the existing pipeline_path capability (arbitrary local .py execution) and the content-type bypass elevates the realistic impact above what raw CVSS C:L/I:L suggests: if pipeline_path was previously enabled or exposed to a developer with trust in the localhost API, the exploit chain approaches arbitrary local code execution. Absent that flag, impact is limited to pipeline submission and validation abuse. Overall, this is a genuine but low-urgency issue warranting patching rather than emergency response.

An attacker hosts a web page containing JavaScript that POSTs a text/plain-typed body to http://127.0.0.1:8000/api/runs with a crafted pipeline payload. A developer who visits the page while agentflow serve is running triggers the request without a CORS preflight - the browser dispatches it as a simple request, and the pre-patch server processes it, executing a pipeline job on the victim's local AgentFlow runtime. A PoC is indicated by SSVC data, though no public PoC URL is available from the references.