Which versions of AgenticSeek are affected by EUVD-2026-58478?

AgenticSeek contains a critical unauthenticated remote code execution vulnerability allowing any network-adjacent attacker to execute arbitrary system commands.. A patch is available.

How to fix or mitigate EUVD-2026-58478?

Within 24 hours: identify all AgenticSeek deployments (listening on port 7777) and map their network exposure, then contact the vendor to confirm patch availability and request the patched version. Within 7 days: test the available patch in a staging environment and deploy it to all AgenticSeek systems, prioritizing production and externally-accessible instances. Within 30 days: verify all systems run the patched version, implement firewall rules restricting port 7777 access to authorized systems only, and review application logs for exploitation attempts or suspicious queries preceding the patch date.

AgenticSeek EUVD-2026-58478

Q: What is the CVSS score of EUVD-2026-58478?

EUVD-2026-58478 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

| CVE-2026-72776 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-13 VulnCheck

GHSA-wrjr-rgfw-cm84

Authentication Bypass RCE Agenticseek

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Endpoint is network-reachable with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); RCE within the app process yields full C/I/A:H, and no confirmed authority change beyond the host process keeps scope unchanged (S:U).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 13, 2026 - 22:10 vuln.today

Analysis Generated

Aug 13, 2026 - 22:10 vuln.today

CVE Published

Aug 13, 2026 - 21:14 cve.org

CRITICAL 9.3

DescriptionCVE.org

AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send unauthenticated HTTP requests that cause the autonomous agent to generate and execute shell commands through BashInterpreter using subprocess.Popen with shell=True and safety=False, bypassing the incomplete command blocklist to achieve full host-level code execution.

AnalysisAI

Unauthenticated remote code execution in AgenticSeek (commit fc242c7) lets any network-adjacent attacker run arbitrary OS commands by POSTing crafted queries to the /query API endpoint, which the autonomous agent turns into shell commands executed via BashInterpreter (subprocess.Popen with shell=True and safety=False). The endpoint listens on 0.0.0.0:7777 with wildcard CORS and no authentication, so a single crafted HTTP request yields full host-level command execution, and an incomplete command blocklist fails to contain it. Rated CVSS 4.0 9.3 (critical); no public exploit identified at time of analysis and not listed in CISA KEV, but exploitation is trivial once the port is reachable.

Technical ContextAI

AgenticSeek is a Python-based autonomous LLM agent that exposes a FastAPI HTTP service. The root cause is CWE-306 (Missing Authentication for Critical Function): the POST /query route is defined with no authentication dependency, and the server binds to all interfaces (0.0.0.0:7777) with a permissive wildcard CORS policy, making the critical query-execution function reachable by anyone who can route to the port. The design intent is that user queries drive an agent capable of tool use, and one of those tools, BashInterpreter, executes generated shell commands through subprocess.Popen(shell=True) with a safety=False flag that disables guardrails; a denylist of forbidden commands is the only barrier and is incomplete, so command-injection-style bypasses reach the shell. Because shell=True passes the string to a system shell, any attacker-influenced content that the agent emits as a command runs with the privileges of the AgenticSeek process.

RemediationAI

Patch available per vendor advisory: apply the fix from pull request https://github.com/Fosowl/agenticSeek/pull/534 (commit f1eb2cfc721f8a21dd16a8b048a9ca89f3259f6f), which adds a require_api_token FastAPI dependency to the /query route via a new sources/api_auth.py bearer-token guard; a released tagged patched version is not independently confirmed, so pin to the fixed commit. Critically, that guard is off by default - it only enforces authentication when the AGENTICSEEK_API_TOKEN environment variable is set - so after upgrading you must set a strong AGENTICSEEK_API_TOKEN and send it as an Authorization: Bearer header, or the endpoint remains open. As compensating controls until patched: rebind the server from 0.0.0.0 to 127.0.0.1 so it is not network-reachable (trade-off: breaks remote/other-host access to the UI); firewall or block inbound TCP 7777 from all untrusted networks; place the service behind an authenticating reverse proxy (e.g. require Basic/OAuth at the proxy, trade-off: added deployment complexity); and tighten the CORS policy away from wildcard to an explicit allowlist. Do not rely on the command blocklist, which the CVE states is incomplete and bypassable.