CVE-2026-40035
A flaw in Unfurl’s configuration parsing lets attackers enable Flask’s debug mode by default, exposing the Werkzeug debugger and potentially allowing remote code execution.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Unfurl by Ryandfir, versions up to 2025.08, used by organizations running the Unfurl service on their servers.
Real-world impact
An attacker can trigger Flask’s debug mode, gaining access to the interactive debugger, which can reveal sensitive data and allow arbitrary code execution on the host system.
Why this severity
The CVSS score of 9.3 reflects the high impact of remote code execution and the lack of authentication or user interaction required, making the vulnerability critical.
What to do about it
- ›Disable Flask debug mode in the Unfurl configuration (set debug to false or remove the debug setting).
- ›Upgrade to a version newer than 2025.08 if available.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
NVD description
Timeline
- Apr 8, 2026 · Apr 8, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/obsidianforensics/unfurl/se…exploitvendor advisory
- vulncheck.com/advisories/dfir-unfurl-werk…third party advisory