CVE-2026-72776: AgenticSeek Unauthenticated RCE via /query API Endpoint
AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected POST /query API endpoint bound to 0.0.0.0:7777 with wildcard CORS. Attackers can send unauthenticated HTTP requests that cause the autonomous agent to generate and execute shell commands through BashInterpreter using subprocess.Popen with shell=True and safety=False, bypassing the incomplete command blocklist to achieve full host-level code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72776?
CVE-2026-72776 has a critical severity score of 9.8.
How do I fix CVE-2026-72776?
To fix CVE-2026-72776, you should restrict access to the /query API endpoint and implement authentication mechanisms.
What type of vulnerability is CVE-2026-72776?
CVE-2026-72776 is an unauthenticated remote code execution (RCE) vulnerability.
Who is affected by CVE-2026-72776?
CVE-2026-72776 affects users of the AgenticSeek application that have the vulnerable version installed.
How can an attacker exploit CVE-2026-72776?
An attacker can exploit CVE-2026-72776 by submitting crafted queries to the unprotected POST /query API endpoint to execute arbitrary commands.