CVE-2026-7439 | BDVDB-2026-329620 Detail

Description#

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation weakness through browser-driven or local cross-origin requests to abuse the localhost API and enable attack chains against the local control plane.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-04-29Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.