High 8.1Published Oct 23, 2026

CVE-2026-115727AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server

Updated under an hour ago (Oct 28, 2026, 11:40 PM ET)

Does this affect you?

It affects Fosowl AgenticSeek. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.70%, higher than 53% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Fosowl AgenticSeek

Exploited in the last 30 days

AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-489
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.70% (percentile 53)
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Oct 27, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Fosowl AgenticSeek fosowl:agenticseek (from the name)	before 409840c033851d861c5c83a91c05fd4a2a75a096	CNA record

References

References

https://github.com/Fosowl/agenticSeek/commit/409840c033851d861c5c83a91c05fd4a2a75a096	patch
https://github.com/Fosowl/agenticSeek/pull/558	issue-tracking, patch
https://github.com/Fosowl/agenticSeek/blob/d238f8e5de10e4ece40d93d80fb4daa4c8a2f34b/llm_server/app.py#L52-L53	technical-description
https://www.vulncheck.com/advisories/agenticseek-before-commit-409840c-rce-via-exposed-werkzeug-debugger-in-llm-server	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.