Is CVE-2026-40035 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40035 being exploited in the wild.

How severe is CVE-2026-40035?

Critical severity, with a CVSS score of 9.1, published 8 April 2026.

Which products and versions are affected?

dfir-unfurl (PyPI) ECOSYSTEM:introduced=0,last_affected=20250810.

Is there a fix for CVE-2026-40035?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40035 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-40035?

Check whether you run dfir-unfurl (PyPI) or RyanDFIR Unfurl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40035: RyanDFIR Unfurl Flask debug mode enabled by default

CVE-2026-40035 · Severity: critical · CVSS 9.1 · Published 2026-04-08

Unfurl, a web application used for digital forensics and URL analysis, contains a flaw that forces it to run in 'debug mode' by default. This mode is intended only for developers and, when active, provides a window into the application's internal workings. An attacker can exploit this to view sensitive system information or potentially take full control of the server.

Technologies: dfir-unfurl (PyPI), RyanDFIR Unfurl. Vendors: PyPI, RyanDFIR.

Quick answers

Is CVE-2026-40035 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40035 being exploited in the wild.
How severe is CVE-2026-40035?: Critical severity, with a CVSS score of 9.1, published 8 April 2026.
Which products and versions are affected?: dfir-unfurl (PyPI) ECOSYSTEM:introduced=0,last_affected=20250810.
Is there a fix for CVE-2026-40035?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40035 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-40035?: Check whether you run dfir-unfurl (PyPI) or RyanDFIR Unfurl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in Unfurl's configuration parsing logic within `unfurl/app.py`. The application reads the `debug` setting from `unfurl.ini` as a string and passes it directly to Flask's `app.run(debug=...)`. Because Python evaluates any non-empty string (including 'False') as Truthy, debug mode remains active regardless of the configuration setting. This exposes the Werkzeug debugger to the network. If an attacker can trigger an application error or bypass the debugger PIN, they can achieve arbitrary code execution or disclose sensitive environment variables and stack traces.

Affected products

RyanDFIR / Obsidian Forensics Unfurl (dfir-unfurl) through 2025.08

Identifiers

CVE-2026-40035
GHSA-vg9h-jx4v-cwx2

Timeline

2026-01-28: disclosed: Initial disclosure via GitHub Security Advisory
2026-04-08: advisory: NVD and VulnCheck publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.