CVE-2026-115727
8.1 HIGHpublic exploit availablePublished 2026-10-23 · Updated 2026-10-23
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-489
Public exploit & PoC references
All references
- https://github.com/Fosowl/agenticSeek/blob/d238f8e5de10e4ece40d93d80fb4daa4c8a2f34b/llm_server/app.py#L52-L53
- https://github.com/Fosowl/agenticSeek/commit/409840c033851d861c5c83a91c05fd4a2a75a096
- https://github.com/Fosowl/agenticSeek/pull/558
- https://www.vulncheck.com/advisories/agenticseek-before-commit-409840c-rce-via-exposed-werkzeug-debugger-in-llm-server
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-100102
- MEDIUMCVE-2026-100295
- CRITICALCVE-2026-102628
- CRITICALCVE-2026-103475PoC
- UNSCOREDCVE-2026-13313
- MEDIUMCVE-2026-15575
- UNSCOREDCVE-2026-50228
- LOWCVE-2026-73593
Related by shared AI tags and CWE weakness class. Browse the full archive.