EUVD-2026-26278Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Browser-driven cross-origin delivery makes AV:N appropriate; UI:R because victim must visit attacker page; no attacker privileges; limited C/I from pipeline abuse.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation weakness through browser-driven or local cross-origin requests to abuse the localhost API and enable attack chains against the local control plane.
AnalysisAI
Content-type validation bypass in AgentFlow's localhost web API allows browser-driven cross-origin requests to reach the POST /api/runs and POST /api/runs/validate control plane endpoints without enforcement of application/json. Affected versions prior to commit 1667fa3 (CPE: cpe:2.3:a:berabuddies:agentflow:*) fail to reject non-JSON content types, enabling a malicious web page visited by a local AgentFlow user to issue CORS-simple requests that bypass the browser's same-origin enforcement and submit pipeline operations to the local agent runtime. No active exploitation is confirmed in CISA KEV; the SSVC framework records a PoC with partial technical impact and non-automatable exploitation.
Technical ContextAI
AgentFlow (berabuddies, CPE: cpe:2.3:a:berabuddies:agentflow:*:*:*:*:*:*:*:*) is an AI pipeline orchestration tool that exposes a local HTTP API on 127.0.0.1:8000 when started with agentflow serve. CWE-346 (Origin Validation Error) is the root cause class: browsers classify POST requests carrying non-JSON content types such as text/plain as CORS 'simple requests,' which are dispatched without a preflight OPTIONS check. Because the pre-patch server did not enforce application/json on /api/runs and /api/runs/validate, a cross-origin page could submit pipeline payloads directly. Compounding this, the pipeline_path parameter was unrestricted by default, meaning a crafted request could instruct the server to load and execute an arbitrary local .py file by filesystem path. The fix (commit 1667fa3, PR #18) adds a _require_json_request() guard that returns HTTP 415 on non-JSON content types and gates pipeline_path behind an explicit AGENTFLOW_API_ALLOW_PIPELINE_PATH=1 environment variable.
RemediationAI
Update AgentFlow to a revision at or after commit 1667fa3 by pulling from the upstream repository (https://github.com/berabuddies/agentflow/commit/1667fa3). No tagged semantic release version is confirmed from available data - the fix exists as a commit and PR only. After updating, the API will return HTTP 415 for any POST to /api/runs or /api/runs/validate that does not carry Content-Type: application/json. Additionally, pipeline_path is now disabled by default in the web API; if your workflow requires it, enable it explicitly with AGENTFLOW_API_ALLOW_PIPELINE_PATH=1 only in trusted operator-controlled environments, as enabling it allows the API to load local .py files by path. As a pre-patch workaround, avoid running agentflow serve simultaneously with browsing untrusted websites, or use browser extensions that block outbound requests to localhost from web pages.
Authentication bypass in Flowring Agentflow workflow system allows unauthenticated remote attackers to exploit specific
Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attacker
Missing authentication in Flowring Agentflow allows unauthenticated attackers to read, modify, and delete data. Second a
The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. Rated critical seve
Agentflow versions up to - is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
Agentflow BPM enterprise management system has improper authentication. Rated high severity (CVSS 8.8), this vulnerabili
Arbitrary code execution in berabuddies AgentFlow (all versions prior to fix commit 1667fa3) allows attackers to run loc
Agentflow BPM file download function has a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerabil
Reflected XSS in AgentFlow enables unauthenticated attackers to inject malicious JavaScript that executes in victims' br
Authenticated attackers can inject malicious JavaScript into Flowring's AgentFlow platform that persists and executes in
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today