AgenticSeek: Remote code execution via exposed Werkzeug debugger

Summary

AgenticSeek before commit 409840c runs the llm_server Flask application with debug mode hardcoded on and bound to all network interfaces. An attacker who can reach the server port and obtain the Werkzeug debugger PIN can execute Python code and operating system commands with the privileges of the llm_server process. The attack requires network access to the port and the derivable debugger PIN, and no login is needed.

Affected

• AgenticSeek versions before commit 409840c033851d861c5c83a91c05fd4a2a75a096
• Affected file: llm_server/app.py
• Unknown: whether a tagged release contains the fix

Fixed in

• Commit 409840c033851d861c5c83a91c05fd4a2a75a096 sets debug=False in llm_server/app.py
• Unknown: first tagged release containing the fix

Workaround

• Block the llm_server port at the host firewall and the network edge
• Do not publish the port through a reverse proxy or tunnel
• No confirmed patch-independent workaround from the vendor

Exploitation

• No evidence of exploitation in the wild
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total
• No public proof of concept found
• Not listed in CISA KEV according to one aggregator

Our recommendation

• Check whether AgenticSeek is installed anywhere, including developer machines and test servers
• Update to commit 409840c or later if the affected version is in use
• Make sure the llm_server port is not reachable from untrusted networks or the internet
• If the instance was reachable before patching, treat it as potentially compromised and review logs and host integrity
• Monitor the GitHub commit and the VulnCheck advisory for updates

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Fix commit 409840c github.com
• Affected code at d238f8e (app.py) github.com
• Pull request #558 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:03.