External risk intelligence

AgenticSeek Unauthenticated Remote Code Execution via Query API

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-72776

The vulnerability exists in an API endpoint bound to 0.0.0.0 (all interfaces), which is intended for receiving and processing queries. Because it is unauthenticated and uses wildcard CORS, it is designed to be accessible as a public-facing service endpoint for autonomous agent operations.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in AgenticSeek allows unauthenticated attackers to execute arbitrary commands on affected systems via crafted queries to the POST /query API. This could lead to full host-level compromise if the technology is in use and exposed externally.

Unauthenticated remote code execution risk.
Matters for systems processing external queries.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the AgenticSeek application over the network and send specially crafted requests to an unprotected API endpoint. This endpoint is designed to process queries and, due to its configuration, allows unauthenticated access. The vulnerability allows an attacker to bypass incomplete command restrictions and execute arbitrary shell commands on the host system.

Unauthenticated network access to API.
Submitting crafted queries to POST /query.
Full host-level code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker on the network to execute arbitrary commands on the affected system when submitting crafted queries to the exposed API. The autonomous agent, when processing these queries, may bypass security measures to run shell commands through BashInterpreter, leading to full host-level code execution.

Host-level code execution.
Crafted queries to unprotected API.
Full control over the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The AgenticSeek commit fc242c7, a critical unauthenticated remote code execution vulnerability in the `/query` API endpoint, likely falls under the responsibility of the application or platform team that deployed and manages AgenticSeek. The first practical step involves identifying all instances of AgenticSeek within the environment, confirming their network accessibility and business criticality, and then locating the accountable owner to plan remediation.

Identify AgenticSeek instances and owners.
Verify network reachability and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is AgenticSeek?

AgenticSeek is an autonomous agent framework. Developers use it to build systems capable of processing queries and interacting with the host environment to perform tasks. The version identified in commit fc242c7 includes a specialized BashInterpreter component designed to execute system-level commands as part of its automated workflow.

What does CWE-306 mean for CVE-2026-72776?

CWE-306 identifies a Missing Authentication for Critical Function. For this CVE, it means the application performs sensitive operations—specifically executing shell commands on the host—without first verifying the identity of the requester. Because the API lacks this check, the system assumes any incoming query is trusted and safe to run.

How is this code execution triggered?

An attacker triggers the vulnerability by sending a specially crafted HTTP POST request to the /query endpoint. The attack succeeds because the system processes these inputs through a shell interface without sufficient validation. Importantly, sending standard or non-malicious queries that do not attempt to bypass command restrictions will not trigger the flaw; only inputs designed to exploit the BashInterpreter cause the insecure execution.

Is my instance at risk?

According to Halo Surface Signal, this software defaults to binding its API to 0.0.0.0, meaning it listens on all network interfaces. Because the endpoint is unauthenticated and uses wildcard CORS, it is likely accessible to any device on your network. If your instance is reachable from the internet or even just from broader internal network segments, it is considered highly exposed.

What should I do first to address this?

Start by performing an inventory to locate every instance of AgenticSeek running in your environment. Once identified, verify their network configuration to see if they are reachable beyond authorized systems. Finally, engage the team responsible for managing these specific deployments to assess business criticality and coordinate the necessary remediation steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.