CVE-2026-112265

LangBot's plugin runtime (pip package langbot_plugin) through version 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 with authentication based on a key that defaults to an empty string and is never set. A remote attacker can register an arbitrary 'debug plugin' without credentials, receive full context of IM messages, inject forged replies, send messages as bots, read knowledge bases, and register malicious tools.

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

LangBot version 4.10.7 and earlier has a vulnerability that allows any authenticated user to add or change an STDIO MCP server configuration without an adequate authorization boundary. An attacker can configure commands and arguments that are executed as a subprocess on the LangBot server, enabling arbitrary command execution with LangBot service privileges.

In LangBot versions 4.1.0 up to but not including 4.3.5, the /api/v1/files/documents interface allows authorized attackers to perform arbitrary file uploads. The lack of strict restriction on the storage directory enables uploading dangerous files to system directories.