CVE-2026-90938
Received Received - Intake

LangBot Plugin Debug WebSocket Authentication Bypass

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary "debug plugin" without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker's plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user's LLM pipeline. Registering with "prod_mode": true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90938
EUVD
EUVD-2026-77456

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
langbot langbot to 0.4.17 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LangBot's plugin runtime through version 0.4.17 starts an unauthenticated debug WebSocket server on port 5401. The server uses a default empty authentication key that is never set, allowing remote attackers to register arbitrary debug plugins without credentials. This grants attackers access to sensitive data like private messages and user IDs, enables message forgery, and allows injecting malicious tools into LLM pipelines.

Detection Guidance

Check if port 5401 is open and accessible on your system. Use commands like 'netstat -tuln | grep 5401' or 'ss -tuln | grep 5401' to see if the WebSocket server is running. If the port is exposed to the network, the vulnerability likely exists.

Impact Analysis

Attackers can read all IM messages in plaintext, including private chats and message chains. They can send forged replies, impersonate bots, enumerate bot UUIDs, invoke LLM models, read knowledge-base contents, and register malicious tools that feed into user LLM pipelines. Registering a plugin with prod_mode true can also block legitimate plugins, causing persistent denial of service.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive personal data (messages, user IDs) in plaintext. It enables large-scale data exposure and potential data breaches, which are prohibited under these regulations without proper safeguards.

Mitigation Strategies

Immediately close port 5401 if it is exposed to the network. Update the plugin runtime to a patched version if available. If no patch exists, disable the WebSocket server or bind it to 127.0.0.1 instead of 0.0.0.0. Generate a strong random plugin_debug_key if the service must remain operational.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90938. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart