Skip to content
Heist/ feed
Back to feed
High

LangBot: Authenticated RCE Via MCP Configuration

Type: advisorySources: OSV

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-54449
Confirmed fixed CVEs
Not specified
Updated in this feed
5 Nov 2026, 04:17 UTC · Revision 1

Source evidence

LangBot: Authenticated RCE Via MCP Configuration

core-osv · Original source

Published 20 Aug 2026, 16:10 UTC

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.

osv:CVE-2026-54449
Complete source record
{
  "id": "f12748c686062ac91c84a6948437f4783276d592be155c46d06a282a52b60bc7",
  "url": "https://osv.dev/vulnerability/CVE-2026-54449",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "LangBot: Authenticated RCE Via MCP Configuration",
    "summary": "LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.",
    "evidence": "osv:CVE-2026-54449",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-54449",
      "aliases": [
        "CVE-2026-54449",
        "GHSA-3pvh-63gf-j9mw",
        "PYSEC-2026-3473"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/langbot-app/langbot",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "1f1a3aff55d828ac2ccc51b2f3ec6b0e78c0a56b"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "4.10.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "4.10.7"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v4.10.7",
            "v4.10.6",
            "v4.10.5",
            "v4.10.4",
            "v4.10.3",
            "v4.10.2",
            "v4.10.1",
            "v4.10.0",
            "v4.10.0-beta.3",
            "v4.10.0-beta.2",
            "v4.9.7",
            "v4.9.6",
            "v4.9.5",
            "v4.9.4",
            "v4.9.3",
            "v4.9.2",
            "v4.9.1",
            "v4.9.0",
            "v4.8.7",
            "v4.8.6",
            "v4.8.5",
            "v4.8.4",
            "v4.8.3",
            "v4.8.2",
            "v4.8.1",
            "v4.8.0",
            "v4.7.2",
            "v4.7.1",
            "v4.7.0",
            "v4.6.5",
            "v4.6.4",
            "v4.6.3",
            "v4.6.2",
            "v4.6.1",
            "v4.6.0",
            "v4.5.4",
            "v4.5.3",
            "v4.5.1b3",
            "v4.5.1b2",
            "v4.5.1b1",
            "v4.5.0",
            "v4.4.2b1",
            "v.4.4.2b1",
            "v4.4.1",
            "v4.4.0",
            "v4.3.9",
            "v4.3.8",
            "v4.3.7",
            "v4.3.7b1",
            "v4.3.6",
            "v4.3.5",
            "v4.3.4",
            "v4.3.3",
            "v4.3.2",
            "v4.3.1",
            "v4.3.0",
            "v4.2.2",
            "v4.3.0.beta2",
            "v4.2.1",
            "v4.2.0",
            "v4.1.2",
            "v4.1.1",
            "v4.1.0",
            "v4.0.9",
            "v4.0.8.1",
            "v4.0.8",
            "v4.0.7",
            "v4.0.6",
            "v4.0.5",
            "v4.0.4",
            "v4.0.3.3",
            "v4.0.3.2",
            "v4.0.3.1",
            "v4.0.3",
            "v4.0.2",
            "v4.0.1",
            "v4.0.0",
            "v4.0.0-beta.2",
            "v4.0.0-beta.1",
            "v3.4.14.3",
            "v3.4.14.2",
            "v3.4.14.1",
            "v3.4.14",
            "v3.4.13.1",
            "v3.4.13",
            "v3.4.12.1",
            "v3.4.12",
            "v3.4.11.2",
            "v3.4.11.1",
            "v3.4.11",
            "v3.4.10.4",
            "v3.4.10.3",
            "v3.4.10.2",
            "v3.4.10.1",
            "v3.4.10",
            "v3.4.9.5",
            "v3.4.9.4",
            "v3.4.9.3",
            "v3.4.9.2",
            "v3.4.9.1",
            "v3.4.9",
            "v3.4.8",
            "v3.4.7.2",
            "v3.4.7.1",
            "v3.4.7",
            "v3.4.6.2",
            "v3.4.6.1",
            "v3.4.6",
            "v3.4.5.2",
            "v3.4.5.1",
            "v3.4.5",
            "v3.4.4.1",
            "v3.4.4",
            "v3.4.3.2",
            "v3.4.3.1",
            "v3.4.3",
            "v3.4.2.1",
            "v3.4.2",
            "v3.4.1.6-pre",
            "v3.4.1.5",
            "v3.4.1.4",
            "v3.4.1.3",
            "v3.4.1.2",
            "v3.4.1.1",
            "v3.4.1",
            "v3.4.0.2",
            "v3.4.0.1",
            "v3.4.0",
            "v3.3.1.1",
            "v3.3.1.0",
            "v3.3.0.2",
            "v3.3.0.1",
            "v3.3.0",
            "v3.2.4",
            "v3.2.3",
            "v3.2.2",
            "v3.2.1",
            "v3.2.0.1",
            "v3.2.0",
            "v3.1.1",
            "v3.1.0.4",
            "v3.1.0.3",
            "v3.1.0.2",
            "v3.1.0.1",
            "v3.1.0",
            "v3.0.2",
            "v3.0.1.3",
            "v3.0.1",
            "v3.0.0",
            "v2.6.10",
            "v2.6.9",
            "v2.6.8",
            "v2.6.7",
            "v2.6.6",
            "v2.6.5",
            "v2.6.4",
            "v2.6.3",
            "v2.6.2",
            "v2.6.1",
            "v2.6.0",
            "v2.5.2",
            "v2.5.1",
            "v2.5.0",
            "v2.4.7",
            "v2.4.6",
            "v2.4.5",
            "v2.4.3.1",
            "v2.4.3",
            "v2.4.2",
            "v2.4.1",
            "v2.4.0",
            "v2.3.9",
            "v2.3.8",
            "v2.3.7",
            "v2.3.6",
            "v2.3.5",
            "v2.3.4",
            "v2.3.3",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.5",
            "v2.1.4",
            "v2.2.4",
            "v2.2.3",
            "v2.2.2",
            "v2.2.1",
            "v2.2.0",
            "v2.1.3",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.0.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.0",
            "v0.1.0",
            "noReleaseProvided"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54449.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:42.456951189Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54449.json",
        "https://github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-54449",
        "https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-77"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54449.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-54449",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 510200,
  "published_at": "2026-08-20T16:10:25.169+00:00"
}