CVE-2026-40035: 
NixOS vulnerability analysis and mitigation

CVE-2026-40035 is an Active Debug Code vulnerability (CWE-489) in Unfurl (dfir-unfurl), a digital forensics URL analysis tool, affecting all versions through 2025.08. The flaw causes Flask debug mode to be enabled by default due to improper string-based config parsing, inadvertently exposing the Werkzeug interactive debugger to network-accessible attackers. It was published on April 8, 2026, with a GitHub Security Advisory (GHSA-vg9h-jx4v-cwx2) published January 28, 2026. The vulnerability carries a CVSS v4.0 base score of 9.3 (Critical) and a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Unfurl Advisory).

The root cause is improper input validation in Unfurl's configuration parsing logic (CWE-489). In unfurl/app.py, the web_app() function reads the debug setting via config['UNFURL_APP'].get('debug'), which returns a Python string rather than a boolean. This string is passed directly to app.run(debug=unfurl_debug, ...), and since any non-empty string evaluates as truthy in Python, debug mode is always active — even when unfurl.ini explicitly sets debug = False. The default argument for the debug parameter is the string "True", meaning debug mode cannot be reliably disabled through configuration. When the Werkzeug debugger is active and the service is network-accessible, unauthenticated attackers can interact with the debugger interface (Unfurl Advisory).

Successful exploitation allows unauthenticated, network-based attackers to access the Werkzeug interactive debugger, which exposes sensitive information including application source code, stack traces, and environment variables (including secrets and API keys). If an attacker obtains or bypasses the Werkzeug debugger PIN, they can achieve remote code execution on the host running the Unfurl service. The impact is rated High for both confidentiality and integrity, with no availability impact; however, RCE potential makes this effectively a full system compromise risk for externally exposed instances (Unfurl Advisory, GitHub Advisory).

A proof-of-concept script (security_poc/poc_debug_mode.py) is publicly available in the Unfurl security advisory, which spawns a local server with debug = False in the config and confirms that debug mode is active by inspecting server logs. The PoC demonstrates the vulnerability but does not achieve full RCE or data exfiltration. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.099%–0.18%, indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Unfurl Advisory, GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Unfurl instances (versions ≤ 2025.08) using tools like Shodan or Censys, searching for the Unfurl web application on its default port (5000 or configured port).
2. Confirm debug mode: Send an HTTP GET request to a non-existent endpoint (e.g., http://<target>:<port>/__nonexistent__) and check if the response contains Werkzeug Debugger or a Python traceback, confirming the debugger is active.
3. Access the Werkzeug debugger: Navigate to the Werkzeug interactive debugger interface exposed at error pages or directly via the debugger endpoint. The debugger allows inspection of the Python call stack and environment.
4. Extract sensitive information: Use the debugger console to read environment variables (including API keys, secrets), application source code, and configuration files.
5. Achieve RCE (if PIN obtainable): If the Werkzeug debugger PIN can be derived (using information from /proc/self/cgroup, /etc/machine-id, and MAC address — all potentially readable via the debugger), authenticate to the interactive console and execute arbitrary Python code on the server (Unfurl Advisory).

• Network: Unexpected HTTP requests to non-existent or error-triggering endpoints on the Unfurl service port; HTTP responses containing Werkzeug Debugger or Traceback (most recent call last) in the body; access to /__debugger__ or similar Werkzeug debugger paths.
• Logs: Unfurl/Flask server logs showing Debug mode: on or Debugger is active! at startup; repeated 404 or 500 responses to unusual paths from external IP addresses.
• Process: The Unfurl Python process spawning unexpected child processes (e.g., shell commands executed via the Werkzeug interactive console); unusual outbound network connections from the Unfurl process.
• File System: New or modified files in the Unfurl working directory created by the application user account; unexpected scripts or web shells written to accessible directories.

Upgrade Unfurl to a version beyond 2025.08 once a patched release is available; as of the advisory publication, no patched version was listed. As an immediate workaround, restrict network access to the Unfurl service so it is only accessible from localhost (127.0.0.1) and not bound to 0.0.0.0 or exposed via a reverse proxy to untrusted networks. Operators should also audit their deployment to confirm the service is not externally reachable, and monitor server startup logs for Debug mode: on as an indicator of the vulnerable state (Unfurl Advisory, GitHub Advisory).

The vulnerability was reported by the mobasi-team and published by RyanDFIR (obsidianforensics) via GitHub Security Advisory. Coverage appeared on threat intelligence aggregators including The Hacker Wire, VulnCheck, and Yazoul.net shortly after disclosure. Social media discussion was noted on Bluesky and Mastodon, with community commentary highlighting the risk of debug mode exposure in forensics tooling that may be deployed in sensitive environments (Unfurl Advisory).