How do I tell whether my AgenticSeek install is patched?

Open llm_server/app.py in your AgenticSeek checkout and read the Flask run call. A patched copy sets debug to false and carries a comment warning that the Werkzeug debugger is remote code execution on 0.0.0.0. AgenticSeek publishes no tagged releases, so the only route to the fix is pulling commit 409840c or anything later on the main branch.

Does the AgenticSeek fix stop the server binding to every interface?

No, the host binding did not change. Commit 409840c turns Flask debug mode off, and llm_server still listens on 0.0.0.0 afterwards. Operators who want the service reachable only from the local machine have to arrange that themselves, through a firewall rule, a different bind address or a private network, rather than relying on the upstream fix.

What can an attacker do with the exposed Werkzeug debugger?

Werkzeug's debug console evaluates Python that the caller supplies. VulnCheck states that an attacker who reaches the llm_server port and obtains the debugger PIN, which the advisory says can be derived, runs arbitrary Python and operating system commands with the privileges of the llm_server process. Code execution at that level reaches the host's files and its environment.

Was the AgenticSeek debug flaw fixed before the CVE was published?

Yes. Maintainer Fosowl merged pull request 558 on 15 October 2026, a broad hardening change that also switched Flask debug mode off in llm_server/app.py. VulnCheck published CVE-2026-115727 eight days later, on 23 October. Anyone who last pulled AgenticSeek before 15 October still runs the vulnerable code, because no tagged release signals the change.

HIGHVulnerability

AgenticSeek: Flask debug mode left on exposes the agent host to RCE

AgenticSeek's llm_server ran Flask in debug mode on 0.0.0.0, turning the Werkzeug debugger into a remote code execution path.

October 23, 2026 · VulnCheck · Research by huangjicheng

CVE-2026-115727

HIGHVulnerability

AgenticSeek shipped llm_server with Flask debug mode hardcoded on while binding to all interfaces. An attacker who reaches the port and derives the Werkzeug PIN runs commands as the server process. Fixed in commit 409840c.

01What happened

VulnCheck published CVE-2026-115727 on 23 October 2026, credited huangjicheng with the finding and scored it 9.2. The flaw sat in llm_server/app.py of AgenticSeek, the self-hosted autonomous agent project maintained by Martin Legrand. Maintainer Fosowl had already turned debug mode off in commit 409840c, merged on 15 October, eight days before the advisory went public.

02How it works

AgenticSeek started Flask with debug mode hardcoded on while binding to 0.0.0.0, so the Werkzeug interactive debugger answered on every network interface. Werkzeug's debug console evaluates Python sent by the caller, gated only by a PIN that the advisory says can be derived. A caller who reaches the port and obtains that PIN runs arbitrary Python and operating system commands with the privileges of the llm_server process. VulnCheck classifies the weakness as CWE-489, active debug code.

03Who is affected

Every AgenticSeek checkout before commit 409840c is affected. The project publishes no tagged releases, so users follow the main branch directly and have no version number to check. Exposure depends on running the llm_server component: anyone who can reach its port is a potential attacker.

04What to do

Pull AgenticSeek at commit 409840c or later, which sets Flask debug mode to off in llm_server/app.py. Keep the llm_server port off untrusted networks either way, because the fix did not change the host binding and the service still listens on 0.0.0.0.

Questions people ask

How do I tell whether my AgenticSeek install is patched?: Open llm_server/app.py in your AgenticSeek checkout and read the Flask run call. A patched copy sets debug to false and carries a comment warning that the Werkzeug debugger is remote code execution on 0.0.0.0. AgenticSeek publishes no tagged releases, so the only route to the fix is pulling commit 409840c or anything later on the main branch.
Does the AgenticSeek fix stop the server binding to every interface?: No, the host binding did not change. Commit 409840c turns Flask debug mode off, and llm_server still listens on 0.0.0.0 afterwards. Operators who want the service reachable only from the local machine have to arrange that themselves, through a firewall rule, a different bind address or a private network, rather than relying on the upstream fix.
What can an attacker do with the exposed Werkzeug debugger?: Werkzeug's debug console evaluates Python that the caller supplies. VulnCheck states that an attacker who reaches the llm_server port and obtains the debugger PIN, which the advisory says can be derived, runs arbitrary Python and operating system commands with the privileges of the llm_server process. Code execution at that level reaches the host's files and its environment.
Was the AgenticSeek debug flaw fixed before the CVE was published?: Yes. Maintainer Fosowl merged pull request 558 on 15 October 2026, a broad hardening change that also switched Flask debug mode off in llm_server/app.py. VulnCheck published CVE-2026-115727 eight days later, on 23 October. Anyone who last pulled AgenticSeek before 15 October still runs the vulnerable code, because no tagged release signals the change.

Sources 3 links, all fetched

1vulncheck.comVulnCheck Advisory
2github.comFix Commit
3github.comHardening Pull Request