CVE-2026-54449

HIGH 8.8

LangBot: Authenticated RCE Via MCP Configuration

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.

CWE	CWE-77
Vendor	langbot-app
Product	langbot
Published	Aug 20, 2026

Stay Ahead of the Next One

Get instant alerts for langbot-app langbot

Be the first to know when new high vulnerabilities affecting langbot-app langbot are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

langbot-app / LangBot

<= 4.10.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw ox.security: https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem