CVE-2026-54449
Received Received - Intake

Authenticated Command Injection in LangBot via MCP Server Configuration

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-54449
EUVD
EUVD-2026-63480

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
langbot langbot to 4.10.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated remote code execution (RCE) vulnerability in LangBot version 4.10.7 and earlier. It allows any authenticated user to add or modify an STDIO MCP server configuration without proper authorization. The StdioServerParameters component executes user-supplied commands via subprocesses, enabling attackers to run arbitrary commands with the privileges of the LangBot service.

Detection Guidance

To detect this vulnerability, inspect LangBot's MCP server configurations for unauthorized or suspicious STDIO server entries. Check the file src/langbot/pkg/provider/tools/loaders/mcp.py for StdioServerParameters usage and review server logs for unexpected subprocess executions or command invocations.

Impact Analysis

An attacker with access to an account can exploit this to execute arbitrary commands on the server. This could lead to data disclosure, modification, or destruction, service disruption, or full system compromise. The impact depends on the privileges of the LangBot service account.

Compliance Impact

This vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Immediately revoke access for any unauthorized users and disable the ability for authenticated users to modify MCP server configurations. Review and remove any suspicious STDIO MCP configurations. Monitor for unusual subprocess activity and restrict LangBot service privileges to the minimum required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54449. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart