# AgenticSeek: Flask debug mode left on exposes the agent host to RCE

> AgenticSeek's llm_server ran Flask in debug mode on 0.0.0.0, turning the Werkzeug debugger into a remote code execution path.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-23
- **CVE:** CVE-2026-115727
- **CVSS:** 9.2
- **Affects:** AgenticSeek
- **Research by:** huangjicheng
- **Primary source:** https://vulncheck.com/advisories/agenticseek-before-commit-409840c-rce-via-exposed-werkzeug-debugger-in-llm-server
- **Page:** https://theinjection.dev/items/agenticseek-llm-server-debug-rce/

AgenticSeek shipped llm_server with Flask debug mode hardcoded on while binding to all interfaces. An attacker who reaches the port and derives the Werkzeug PIN runs commands as the server process. Fixed in commit 409840c.

## What happened

VulnCheck published CVE-2026-115727 on 23 October 2026, credited huangjicheng with the finding and scored it 9.2. The flaw sat in llm_server/app.py of AgenticSeek, the self-hosted autonomous agent project maintained by Martin Legrand. Maintainer Fosowl had already turned debug mode off in commit 409840c, merged on 15 October, eight days before the advisory went public.

## How it works

AgenticSeek started Flask with debug mode hardcoded on while binding to 0.0.0.0, so the Werkzeug interactive debugger answered on every network interface. Werkzeug's debug console evaluates Python sent by the caller, gated only by a PIN that the advisory says can be derived. A caller who reaches the port and obtains that PIN runs arbitrary Python and operating system commands with the privileges of the llm_server process. VulnCheck classifies the weakness as CWE-489, active debug code.

## Who is affected

Every AgenticSeek checkout before commit 409840c is affected. The project publishes no tagged releases, so users follow the main branch directly and have no version number to check. Exposure depends on running the llm_server component: anyone who can reach its port is a potential attacker.

## What to do

Pull AgenticSeek at commit 409840c or later, which sets Flask debug mode to off in llm_server/app.py. Keep the llm_server port off untrusted networks either way, because the fix did not change the host binding and the service still listens on 0.0.0.0.

## Quick facts

- **Affected:** AgenticSeek before commit 409840c
- **Fixed in:** Commit 409840c, no tagged release
- **CVE:** CVE-2026-115727
- **CVSS:** 9.2, CVSS 4.0, assigned by VulnCheck
- **Found by:** huangjicheng
- **Disclosed:** 23 October 2026
- **Attack type:** Active debug code, CWE-489

## Questions

### How do I tell whether my AgenticSeek install is patched?

Open llm_server/app.py in your AgenticSeek checkout and read the Flask run call. A patched copy sets debug to false and carries a comment warning that the Werkzeug debugger is remote code execution on 0.0.0.0. AgenticSeek publishes no tagged releases, so the only route to the fix is pulling commit 409840c or anything later on the main branch.

### Does the AgenticSeek fix stop the server binding to every interface?

No, the host binding did not change. Commit 409840c turns Flask debug mode off, and llm_server still listens on 0.0.0.0 afterwards. Operators who want the service reachable only from the local machine have to arrange that themselves, through a firewall rule, a different bind address or a private network, rather than relying on the upstream fix.

### What can an attacker do with the exposed Werkzeug debugger?

Werkzeug's debug console evaluates Python that the caller supplies. VulnCheck states that an attacker who reaches the llm_server port and obtains the debugger PIN, which the advisory says can be derived, runs arbitrary Python and operating system commands with the privileges of the llm_server process. Code execution at that level reaches the host's files and its environment.

### Was the AgenticSeek debug flaw fixed before the CVE was published?

Yes. Maintainer Fosowl merged pull request 558 on 15 October 2026, a broad hardening change that also switched Flask debug mode off in llm_server/app.py. VulnCheck published CVE-2026-115727 eight days later, on 23 October. Anyone who last pulled AgenticSeek before 15 October still runs the vulnerable code, because no tagged release signals the change.

## Sources

1. [VulnCheck Advisory](https://vulncheck.com/advisories/agenticseek-before-commit-409840c-rce-via-exposed-werkzeug-debugger-in-llm-server)
2. [Fix Commit](https://github.com/Fosowl/agenticSeek/commit/409840c033851d861c5c83a91c05fd4a2a75a096)
3. [Hardening Pull Request](https://github.com/Fosowl/agenticSeek/pull/558)