Local Web API Content-Type Validation Bypass in AgentFlow by Berabuddies

CVE-2026-7439

What is CVE-2026-7439?

The vulnerability in AgentFlow's local web API arises from inadequate validation of content types on specific endpoints, namely POST /api/runs and POST /api/runs/validate. This oversight allows malicious actors to submit non-JSON content types, circumventing critical trust-boundary enforcement during sensitive operations. Exploiting this weakness, attackers can leverage browser-driven or local cross-origin requests to manipulate the localhost API, potentially leading to broader exploitation scenarios against the local control plane. Mitigation includes applying the latest patches provided by Berabuddies to secure the affected endpoints.

References