# CVE-2024-34069: PYSEC-2026-2043 - Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

Source: https://junglewise.ai/threats/cve-2024-34069-werkzeug-debugger-remote-code-execution-via-attacker-controlled  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-34069 · Severity: low · CVSS 3.1 · Published 2026-07-07

Werkzeug is a widely-used Python web framework toolkit that includes a development debugger for testing applications. The debugger can be exploited to execute arbitrary code on a developer's machine if they visit a malicious domain controlled by an attacker and enter the debugger PIN. While this requires social engineering and the attacker to guess a triggering URL, successful exploitation grants full code execution on the developer's system.

Technologies: [werkzeug (PyPI)](https://junglewise.ai/threats/technologies/werkzeug). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-34069 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-34069 being exploited in the wild.

**How severe is CVE-2024-34069?** Low severity, with a CVSS score of 3.1, published 7 July 2026.

**Which products and versions are affected?** werkzeug (PyPI) ECOSYSTEM:introduced=0,fixed=3.0.3.

**Is there a fix for CVE-2024-34069?** Yes. werkzeug (PyPI): upgrade to 3.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-34069 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-34069?** Check whether you run werkzeug (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- werkzeug (PyPI): upgrade to 3.0.3 or later

  ```sh
  pip install "werkzeug>=3.0.3"
  ```


## Technical details

The vulnerability is a cross-site request forgery (CWE-352) flaw in the Werkzeug debugger that allows an attacker to gain unauthorized access to the debugger interface. An attacker can craft a malicious domain and subdomain under their control, and if they trick a developer into visiting it, they can bypass the PIN protection and access the debugger even when it is running only on localhost. This requires the attacker to guess a URL that triggers the debugger in the target application, but if successful, provides unrestricted code execution. The vulnerability was patched in version 3.0.3; all earlier versions (0.x through 3.0.2) are affected.

## Affected products

- Pallets Werkzeug <3.0.3

## Identifiers

- CVE-2024-34069
- GHSA-2g68-c3qc-8985
- PYSEC-2026-2043

## Timeline

- 2024-05-06: disclosed
- 2024-05-06: patched: Version 3.0.3 released with fix

## References

- [https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985](https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985)

## Related threats

- [Werkzeug path traversal via NUL device with NTFS ADS marker](https://junglewise.ai/threats/cve-2026-102598-werkzeug-is-a-comprehensive-wsgi-web-application-library-prior)
- [PYSEC-2026-2044 - Werkzeug safe_join() allows Windows special device names with compound extensions](https://junglewise.ai/threats/cve-2026-21860-werkzeug-safe-join-allows-windows-special-device-names-with)
- [PYSEC-2026-2045 - Werkzeug safe_join not safe on Windows](https://junglewise.ai/threats/cve-2024-49766-werkzeug-safe-join-not-safe-on-windows)
- [PYSEC-2026-1065 - Pallets Werkzeug vulnerable to Path Traversal](https://junglewise.ai/threats/cve-2019-14322-pallets-werkzeug-vulnerable-to-path-traversal)
- [Werkzeug safe_join() allows Windows special device names](https://junglewise.ai/threats/cve-2026-27199-werkzeug-safe-join-allows-windows-special-device-names)