Description

LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary "debug plugin" without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker's plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user's LLM pipeline. Registering with "prod_mode": true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-14T13:19:32.430Z",
  "pubdate": "2026-09-14T13:19:32.430Z",
  "executiveSummary": "The langbot_plugin package, versions through 0.4.17, contains a critical authentication bypass vulnerability in its debug WebSocket server implementation. The service, bound to 0.0.0.0:5401, utilizes a 'plugin_debug_key' for authentication which defaults to an empty string. Due to a failure to properly enforce this key across all deployment vectors, including the provided Docker configurations, the authentication check is effectively bypassed.\nThis vulnerability exposes the bot's communication runtime to unauthorized third-party plugin registration. An attacker can remotely register arbitrary plugins without credentials, leading to full surveillance of sensitive IM traffic, message injection, and unauthorized LLM model invocation. Furthermore, the ability to register plugins in 'prod_mode' allows for persistent denial-of-service attacks by preventing legitimate plugin updates. The risk is critical, as it grants complete control over the bot's processing pipeline and internal knowledge base exposure.",
  "technicalDetails": "The vulnerability resides in the initialization logic of the LangBot plugin runtime. The WebSocket server located at /plugin/ws is initialized to listen on all network interfaces (0.0.0.0:5401). The security model relies on the 'plugin_debug_key' variable to gate access to the WebSocket registration endpoint. However, this variable defaults to an empty string, and the upstream repository, Docker image, and docker-compose configurations fail to set a secure value. Because the implementation performs a simple equality check against the default empty value, an attacker can bypass the authentication gate entirely by omitting credentials or providing an empty key.\nThe attack flow begins with the attacker establishing a WebSocket connection to the vulnerable port 5401. Upon successful connection, the attacker transmits a plugin registration payload. Since the server does not enforce the debug key, the LangBot instance registers the malicious plugin as an active component. Once registered, the malicious plugin is included in the global event broadcasting mechanism. This mechanism lacks isolation, meaning the malicious plugin receives a copy of every IM message event processed by the bot, including private communications, message chains, and sensitive user/sender metadata in plaintext.\nPost-exploitation capabilities are extensive. An attacker can inject forged replies into active conversations or send messages masquerading as any configured bot. By invoking configured LLM models or reading internal knowledge-base contents, the attacker can exfiltrate sensitive proprietary data. Additionally, the attacker can register malicious tools that intercept and manipulate the input/output of the user's LLM pipeline, effectively acting as an adversary-in-the-middle for all AI-assisted queries. Finally, by registering a plugin with 'prod_mode': true, the attacker can cause name/author collisions that lead to a persistent denial-of-service condition, where legitimate plugin updates for those specific identifiers are rejected by the runtime environment."
}