CVE-2026-54449
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
LangBot version 4.10.7 and earlier has a vulnerability that allows any authenticated user to add or change an STDIO MCP server configuration without an adequate authorization boundary. An attacker can configure commands and arguments that are executed as a subprocess on the LangBot server, enabling arbitrary command execution with LangBot service privileges.
Risk Assessment
An attacker could execute arbitrary commands on the server, potentially leading to data disclosure, modification, or service disruption.
Recommendation
Apply patches or update LangBot if available. Restrict MCP configuration to trusted users.
Other vulnerabilities in LangBot
See all- CVE-2026-112265Medium
LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lark/Feishu events by skipping signature checks. Attackers knowing a bot UUID can POST fabricated im.message.receive_v1 or card.action.trigger events to drive the LLM pipeline, tools, and approvals as other users.
- CVE-2026-90938High
LangBot's plugin runtime (pip package langbot_plugin) through version 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 with authentication based on a key that defaults to an empty string and is never set. A remote attacker can register an arbitrary 'debug plugin' without credentials, receive full context of IM messages, inject forged replies, send messages as bots, read knowledge bases, and register malicious tools.
- CVE-2026-90562High
LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.
- CVE-2025-59835High
In LangBot versions 4.1.0 up to but not including 4.3.5, the /api/v1/files/documents interface allows authorized attackers to perform arbitrary file uploads. The lack of strict restriction on the storage directory enables uploading dangerous files to system directories.
Original NVD description (English source)
LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS