AgenticSeek CVE-2026-115727

The pre-patch code hardcodes app.run(host='0.0.0.0', threaded=True, debug=True, port=args.port) in llm_server/app.py, so the vulnerable Werkzeug debugger is enabled by default (not an opt-in misconfiguration) and the server is bound to all interfaces. Required for exploitation: (1) network reachability to the llm_server port - anyone able to route to the host, including LAN or internet exposure if not firewalled; (2) the attacker must obtain or derive the Werkzeug debugger PIN (reflected as AT:P in the CVSS 4.0 vector), which is the principal limiting factor on otherwise unauthenticated access. The primary deployment-level limiter is network exposure: instances bound only behind localhost/loopback or a firewall are not remotely reachable. No user interaction and no application authentication are required once the port is reachable and the PIN is obtained.

Multiple decision signals align toward high priority: CVSS 4.0 base score 9.2 (Critical) with AV:N/AC:L/PR:N/UI:N and VC:H/VI:H/VA:H, a vuln.today Decision label of act_now, a vendor patch available, and a dedicated VulnCheck advisory. The vulnerability class is well understood and reliably exploitable - a Flask application hardcoded with debug=True while binding to 0.0.0.0 exposes the Werkzeug interactive debugger, which grants arbitrary Python/OS command execution to anyone who can reach the port and present the correct debugger PIN. One mitigating nuance: the CVSS 4.0 vector sets AT:P (an attack requirement), reflecting that the attacker must obtain the 'derivable' Werkzeug PIN rather than execute entirely unconditionally; this is the one factor separating this from a trivial drive-by RCE. No EPSS probability score and no CISA KEV status were provided in the input, so widespread-exploitation likelihood cannot be quantified and active exploitation is not confirmed; the act_now label here derives from severity, exploitability, and patch availability rather than from observed in-the-wild use. Despite missing EPSS/KEV telemetry, the combination of unauthenticated network reach, full CIA impact, and a defaulted-on debug mode makes this a genuine priority for any exposed AgenticSeek instance rather than a high-CVSS-but-low-real-risk item.

An AgenticSeek llm_server (pre-commit 409840c) is reachable on its network port because it binds to 0.0.0.0 with Flask debug mode hardcoded on. An attacker triggers an application error to surface the Werkzeug debugger, derives the debugger PIN from information the server exposes, and then uses the interactive console to run arbitrary Python and shell commands as the llm_server process. No public exploit was identified at time of analysis, but the technique is a well-documented, low-complexity attack pattern.