CVE-2026-115727: Active Debug Code in Fosowl AgenticSeek
Description
AgenticSeek versions before commit 409840c contain a critical remote code execution vulnerability due to Flask debug mode being hardcoded and exposed on all interfaces. Attackers who can access the server port and derive the Werkzeug debugger PIN can execute arbitrary Python code and OS commands with the privileges of the llm_server process.
CVSS v4.0
Score 9.2critical
Affected software
Fosowl
AgenticSeek
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Fosowl's AgenticSeek (CVE-2026-115727) arises from the hardcoded activation of Flask debug mode in llm_server/app.py, which binds the server to all network interfaces. This exposes the Werkzeug debugger, which requires a PIN that can be derived by attackers. With access to the debugger, attackers can execute arbitrary Python code and operating system commands with the privileges of the llm_server process, leading to remote code execution. The flaw affects versions prior to commit 409840c.
Potential Impact
Successful exploitation allows unauthenticated remote attackers to execute arbitrary code and operating system commands with the privileges of the llm_server process, potentially leading to full system compromise. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity with high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
No explicit patch or remediation details are provided. Since the vulnerability is due to hardcoded debug mode, remediation involves updating AgenticSeek to a version at or after commit 409840c where debug mode is disabled or properly configured. Until then, restrict network access to the affected server port to trusted users only to prevent unauthorized access to the debugger. Monitor vendor advisories for an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-23T11:26:44.374Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6adb4c874d27ba8daa1f3889
Added to database: 10/23/2026, 12:01:11 UTC
Last enriched: 10/23/2026, 12:15:18 UTC
Last updated: 10/23/2026, 12:15:18 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.