CVE-2026-40035 affects the unfurl product by obsidianforensics in versions through 2025.08. The vulnerability arises from improper input validation in the config parsing logic, which enables Flask debug mode by default. Specifically, the debug configuration value is treated as a string and passed directly to app.run(), causing any non-empty string to be interpreted as true. This enables the Werkzeug debugger interface, which can be exploited by attackers to disclose sensitive application information or execute arbitrary code remotely. The vulnerability is classified under CWE-489 (Active Debug Code).

Successful exploitation allows unauthenticated attackers to access the Flask Werkzeug debugger, leading to disclosure of sensitive information and potential remote code execution. This poses a critical risk to affected systems due to the high severity and ease of exploitation (no privileges or user interaction required).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid running vulnerable versions in production environments or disable debug mode manually if possible. Monitor vendor channels for updates and apply patches promptly once released.