CVE-2026-7466 - Vulnerability Analysis

Overview

AgentFlow contains an arbitrary code execution caused by user-controlled pipeline_path parameter in POST /api/runs and /api/runs/validate endpoints, letting attackers execute local Python pipeline files remotely, exploit requires network access.

Severity & Score

Impact

Attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Mitigation

Update to the latest version of AgentFlow.

References

• https://github.com/berabuddies/agentflow/pull/18
• https://github.com/berabuddies/agentflow/pull/18/changes/7e61b6ce846b3d700456e4874394dc868905a9f2
• https://www.vulncheck.com/advisories/agentflow-arbitrary-python-pipeline-execution-via-pipeline-path

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner