CVE-2026-40035

Name: CVE-2026-40035
Creator: NVD / NIST
Published: 2026-04-08T22:16:24.01+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.3/10EPSS 0.56%

Last modified Jun 17, 2026

CVE-2026-40035 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.. EPSS estimates a 0.56% chance of exploitation in the next 30 days.

Description

Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to app.run(), causing any non-empty string to evaluate truthy, allowing attackers to access the Werkzeug debugger and disclose sensitive information or achieve remote code execution.

Metrics

CVSS 3.1

9.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS 4.0

9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.56%

42.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-489

Affected Software

Vendor	Product	Versions
Ryandfir	Unfurl	<= 2025.08

References

https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2Exploit, Vendor Advisory
https://www.vulncheck.com/advisories/dfir-unfurl-werkzeug-debugger-exposure-via-string-config-parsingThird Party Advisory
https://github.com/obsidianforensics/unfurl/security/advisories/GHSA-vg9h-jx4v-cwx2Exploit, Vendor Advisory

Timeline

Published: Apr 8, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-40035?

How severe is CVE-2026-40035?

CVE-2026-40035 has a CVSS score of 9.3/10 (CRITICAL severity). The EPSS model estimates a 0.56% probability of exploitation in the next 30 days.

How do I fix CVE-2026-40035?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-40035?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST