Description

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-20T17:18:17.910Z",
  "pubdate": "2026-08-20T17:18:17.910Z",
  "executiveSummary": "LangBot version 4.10.7 and earlier suffer from an improper authorization vulnerability in the Model Context Protocol (MCP) configuration mechanism. This security flaw allows any authenticated user to create or modify STDIO MCP server configurations without adequate authorization boundaries enforced by the platform.\nThe root cause lies in the handling of server parameters within the application logic, specifically utilizing StdioServerParameters to process user-supplied command strings and arguments which are subsequently executed as server-side system processes.\nAn attacker possessing standard authentication credentials—obtained simply by signing up for an account—can leverage the Extensions MCP configuration interface to execute arbitrary operating system commands. These commands execute with the underlying security privileges of the running LangBot service account.\nThe business impact and risk implications are severe, enabling malicious actors to achieve unauthorized data disclosure, modify critical system resources, and cause complete service disruption. Exploitation requires standard user authentication but bypasses intended administrative role boundaries. As of the current review, no official patched version is available from the vendor, necessitating manual hardening or restricted feature access to mitigate the risk of Remote Code Execution.",
  "technicalDetails": "The vulnerability resides in the backend codebase of LangBot, specifically within the source file src/langbot/pkg/provider/tools/loaders/mcp.py. This component is responsible for loading and initializing Model Context Protocol (MCP) servers based on stored user configurations.\nThe core vulnerable component is the StdioServerParameters class and associated routines, which accept configured command strings and argument arrays directly from configuration inputs. When an MCP server utilizing the standard I/O (STDIO) transport is initialized, the application passes these parameters directly to system process execution functions, spawning a subprocess on the host server hosting the LangBot application.\nAuthentication and privilege requirements for exploitation are minimal. Any authenticated user—including low-privileged accounts created via standard platform self-registration—can access the configuration interfaces intended for defining Extensions MCP setups. Because the application lacks an adequate authorization boundary or role-based access control (RBAC) check on these configuration endpoints, non-administrative users can freely define or alter STDIO MCP server parameters.\nThe step-by-step attack flow proceeds as follows: First, an attacker authenticates to the LangBot platform using a standard user account. Second, the attacker navigates to the Extensions MCP configuration interface or interacts directly with the corresponding API endpoints responsible for updating server settings. Third, the attacker submits a malicious configuration payload where the command or argument fields contain arbitrary operating system commands rather than legitimate MCP binary paths. Fourth, upon triggering the MCP loader or server initialization cycle, the application invokes StdioServerParameters, passing the malicious parameters to the underlying operating system subprocess execution engine. Finally, the operating system executes the injected commands within the execution context and privileges of the LangBot service.\nThe post-exploitation impact includes full system compromise within the security context of the LangBot service account. This allows the adversary to read sensitive application data, tamper with system files, pivot to internal network resources, or terminate the application process to induce a denial of service."
}