CVE-2026-115727
AgenticSeek before commit 409840c contains a remote code execution vulnerability because…
- Risk score
- 66/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 1.0%
- Published
- 23 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- AgenticSeek before commit 409840c contains a remote code execution vulnerability due to hardcoded Flask debug mode. Attackers can execute Python code and OS commands with llm_server privileges.
- Affected
- {'products': ['AgenticSeek'], 'packages': [], 'versions': ['before commit 409840c']}
- Fix
- Check the linked advisory for details
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.1 high
- Remotely exploitable without logging in
References
- https://github.com/Fosowl/agenticSeek/blob/d238f8e5de10e4ece40d93d80fb4daa4c8a2f34b/llm_server/app.py#L52-L53
- https://github.com/Fosowl/agenticSeek/commit/409840c033851d861c5c83a91c05fd4a2a75a096
- https://github.com/Fosowl/agenticSeek/pull/558
- https://www.vulncheck.com/advisories/agenticseek-before-commit-409840c-rce-via-exposed-werkzeug-debugger-in-llm-server
Original description
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.
Last activity 23 Oct 2026. Patch Forecast updates every hour.