LangBot: Authenticated RCE Via MCP Configuration
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| langbot-app | LangBot | up to 4.10.7 | — | No fix listed | CNA |
| — | langbot (PyPI) | up to 4.10.5 | — | No fix listed | GHSA-3pvh-63gf-j9mw |
- LangBot Vendorlangbot-app Affected up to 4.10.7 Fixed in — No fix listed CNA
- langbot (PyPI) Vendor— Affected up to 4.10.5 Fixed in — No fix listed GHSA-3pvh-63gf-j9mw
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54449
- 2026-10-03 Alias added: GHSA-3pvh-63gf-j9mw
References
More langbot-app vulnerabilities
- TI-2026-61802 LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket CVSS 4.0HIGH 8.8
- TI-2026-61576 LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key CVSS 4.0CRITICAL 9.2
- TI-2025-37274 LangBot has a cross-directory file upload vulnerability, which could lead to system takeover CVSS 4.0HIGH 8.6
- TI-2026-76465 Missing Lark/Feishu webhook authenticity check in LangBot CVSS 4.0HIGH 8.3
Sources
- CVE-2026-54449 · CVE Program
- CVE-2026-54449 · NVD
- FIRST EPSS
- GHSA-3pvh-63gf-j9mw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences