CVE-2026-7466

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-7466

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7466.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-7466

Published

2026-04-29T18:44:07Z

Modified

2026-10-28T02:30:24Z

Severity

7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

AgentFlow Arbitrary Python Pipeline Execution via pipeline_path

Details

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to load and execute existing Python pipeline files on disk, resulting in code execution in the context of the user running AgentFlow.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7466.json"
}

References

Affected packages

Git / github.com/berabuddies/agentflow

Affected ranges

Type

GIT

Repo

https://github.com/berabuddies/agentflow

Events

Introduced

Fixed

1667fa3

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1667fa3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7466.json"