CVE-2026-72776
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send unauthenticated HTTP requests that cause the autonomous agent to generate and execute shell commands through BashInterpreter using subprocess.Popen with shell=True and safety=False, bypassing the incomplete command blocklist to achieve full host-level code execution.
Risk Assessment
The risk includes full host takeover by any network-adjacent attacker, potentially leading to data theft, malware installation, and further attacks.
Recommendation
It is recommended to immediately implement authentication and authorization for the /query endpoint, restrict network access, and update AgenticSeek to a patched version.
Other vulnerabilities in AgenticSeek
See all- CVE-2026-115727High
AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. An attacker who reaches the server port and obtains the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.
- CVE-2026-5584High
A vulnerability has been found in Fosowl agenticSeek 0.1.0 affecting the function PyInterpreter.execute in the file sources/tools/PyInterpreter.py of the query Endpoint component. Such manipulation leads to code injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond.
Original NVD description (English source)
AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send unauthenticated HTTP requests that cause the autonomous agent to generate and execute shell commands through BashInterpreter using subprocess.Popen with shell=True and safety=False, bypassing the incomplete command blocklist to achieve full host-level code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS