Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boundary enforcement on sensitive operations. Attackers can exploit this content-type validation weakness through browser-driven or local cross-origin requests to abuse the localhost API and enable attack chains against the local control plane.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-29 | 2 | Disclosure2 |
| 2026-04-30 | 1 | Active Exploitation1 |
Our CTI team identified a lot of activities targeting berabuddies AgentFlow (CVE-2026-7439) https://vuldb.com/vuln/360190/cti
Post summary
CTI notes a surge in attacks targeting CVE‑2026‑7439 for berabuddies AgentFlow, indicating that this vulnerability is being actively exploited in the wild.
CVE-2026-7439 Content-Type Validation Bypass in AgentFlow Local Web API POST Endpoints https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-7439
Post summary
The provided text announces CVE-2026-7439, describing a Content-Type validation bypass in AgentFlow's local web API, but does not include PoC, exploit code, patch details, or evidence of active exploitation.
CVE-2026-7439 AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing… https://www.cve.org/CVERecord?id=CVE-2026-7439
Post summary
The text announces CVE‑2026‑7439, noting that AgentFlow’s local web API incorrectly permits non‑JSON payloads on certain POST endpoints.