External risk intelligence

AgenticSeek LLM Server Remote Code Execution via Hardcoded Debug Mode

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-115727

The application binds the Flask development server to all network interfaces by default. Because this component is designed to function as an LLM server, it is commonly deployed as an API or web-accessible service that may be exposed to network reachability, creating a scenario where the management interface is accessible if not properly firewalled.

Remote Code Execution

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A remote code execution vulnerability has been identified in AgenticSeek's LLM server. This issue arises from a hardcoded debug mode in the application's Python code, which, if accessible externally, could allow attackers to run commands on the server with elevated privileges. The main concern is confirming relevance and exposure.

A coding error allows remote attackers to run commands.
Attackers can gain unauthorized server access.
Confirm if this technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker can execute arbitrary code by reaching the application's server port and obtaining a derivable Werkzeug debugger PIN. This allows them to run Python code and operating system commands with the privileges of the `llm_server`.

Attacker must reach the server port.
Derivable PIN enables debugger access.
Risk of remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker who can reach the server port and obtain the Werkzeug debugger PIN could execute Python code and operating system commands with `llm_server` privileges. This could affect system data and service behavior.

System data and service behavior.
Via network access and debugger PIN.
Unauthorized code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners responsible for the AgenticSeek llm_server are the primary point of contact for this vulnerability. The first critical step is to identify all deployments of this technology, ascertain their network exposure and business criticality, and then confirm the accountable owner before planning remediation.

Confirm application owner and scope.
Verify network exposure and criticality.
Plan remediation or implement controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AgenticSeek and how is it used?

AgenticSeek is a software component designed to function as an LLM server. It provides the infrastructure to host and serve large language models, typically operating as an API or web-accessible service that processes queries and generates responses for integrated applications.

What does CWE-489 mean for CVE-2026-115727?

CWE-489 refers to an 'Authentication Bypass by Capture-the-Flag' or more broadly, leaving a dangerous debug feature active in a production environment. In this CVE, the application hardcodes the Flask debug mode to remain enabled, which exposes the Werkzeug debugger interface to anyone who can reach the server port, bypassing standard security protections.

How can an attacker trigger this RCE vulnerability?

An attacker must be able to reach the server's network port. Once they reach the port, they need to obtain the debugger's PIN, which is often derivable. If the attacker succeeds in both, they can use the debugger console to execute arbitrary Python code and OS-level commands. Note that simply reaching the port is not sufficient if the PIN cannot be determined or bypassed.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates a 'Likely' risk if the service is deployed in a way that allows network reachability. Because this LLM server is designed to be a web-accessible service, it is often deployed on network-reachable infrastructure. You should check if your instance is bound to public interfaces or if it is behind strict firewall controls.

What steps should I take if I run AgenticSeek?

Begin by identifying all deployments of the technology within your environment and confirming who is responsible for each instance. Evaluate the network exposure for these servers and determine their business criticality. Once mapped, verify if you are running a version before commit 409840c and plan to transition to a version where the debugger is disabled.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.