AgentFlow RCE Vulnerability (CVE-2026-7466) Allows Local Code Execution
The National Vulnerability Database has disclosed CVE-2026-7466, an arbitrary code execution vulnerability in AgentFlow. This flaw, rated with a CVSS score of 8.8 (HIGH), allows attackers to execute local Python pipeline files by manipulating the pipeline_path parameter. Specifically, supplying a user-controlled path to the POST /api/runs and POST /api/runs/validate endpoints enables this exploitation.
Attackers can leverage this vulnerability to induce AgentFlow’s local API to load and execute existing Python pipeline files already present on the disk. The consequence is code execution within the security context of the user running AgentFlow. This presents a significant risk, as it bypasses typical application-level controls by directly referencing local files.
While the National Vulnerability Database did not specify affected products beyond AgentFlow itself, the nature of this vulnerability (CWE-94: Improper Control of Generation of Code (‘Code Injection’)) indicates a core design flaw. Defenders need to understand that this isn’t about injecting new code, but rather about misusing the application’s functionality to execute existing code on the system, which can be just as damaging if an attacker can control or place such files.
What This Means For You
- If your organization uses AgentFlow, you need to immediately identify all instances and understand how the `pipeline_path` parameter is handled. Review your deployment for any existing Python pipeline files on disk that could be maliciously executed. Prioritize patching AgentFlow once a fix is available, and in the interim, implement strict input validation and access controls for the `/api/runs` and `/api/runs/validate` endpoints.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-7466 AgentFlow Pipeline Path Traversal RCE
title: CVE-2026-7466 AgentFlow Pipeline Path Traversal RCE
id: scw-2026-04-29-ai-1
status: experimental
level: critical
description: |
Detects the AgentFlow RCE vulnerability (CVE-2026-7466) by identifying POST requests to '/api/runs' or '/api/runs/validate' endpoints that contain the 'pipeline_path=' parameter. This indicates an attempt to exploit the vulnerability by supplying a user-controlled path to a local Python pipeline file, leading to code execution.
author: SCW Feed Engine (AI-generated)
date: 2026-04-29
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-7466/
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/api/runs'
- '/api/runs/validate'
cs-method:
- 'POST'
cs-uri-query|contains:
- 'pipeline_path='
selection_base:
cs-uri|contains:
- '/api/runs'
- '/api/runs/validate'
cs-method:
- 'POST'
selection_indicators:
cs-uri-query|contains:
- 'pipeline_path='
condition: selection_base AND selection_indicators
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-7466 | RCE | AgentFlow |
| CVE-2026-7466 | RCE | POST /api/runs endpoint |
| CVE-2026-7466 | RCE | POST /api/runs/validate endpoint |
| CVE-2026-7466 | RCE | user-controlled pipeline_path parameter |
| CVE-2026-7466 | Code Injection | execution of local Python pipeline files |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 29, 2026 at 22:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-7439 — AgentFlow's local web API accepts non-JSON content types on
CVE-2026-7439 — AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass...
CVE-2026-7424: FreeRTOS-Plus-TCP DHCPv6 Vulnerability Leads to DoS
CVE-2026-7424 — Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network actor to corrupt the device's IPv6...
CVE-2026-7423 — Denial of Service
CVE-2026-7423 — Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause...