Technical impact
LangBot’s plugin runtime starts a debug WebSocket listener on all interfaces (0.0.0.0) at port 5401 for the /plugin/ws endpoint. Authentication for this endpoint is controlled by a variable named plugin_debug_key, which defaults to an empty string and is never set by the upstream code, Docker image, or docker‑compose configurations. As a result, the key check is effectively bypassed. An attacker who can reach that port can register a rogue plugin without any credentials. Once registered, the attacker’s plugin receives every message event, including private chats, message chains, and user identifiers in clear text, and can inject forged replies, have the bot send messages on the attacker’s behalf, enumerate bot UUIDs, invoke any configured LLM models, read knowledge‑base contents, and register malicious tools that consume every user’s LLM pipeline. Registering a plugin with "prod_mode": true also blocks later legitimate installations of plugins with the same author/name, creating a persistent denial of service. These capabilities allow remote code execution, data exfiltration, and service disruption and reflect a lack of proper authentication (CWE‑306).
Affected Systems
The vulnerability affects all releases of LangBot from its inception up to and including version 0.4.17, as well as the accompanying pip package langbot_plugin that provides the WebSocket functionality. The affected vendor product is langbot-app:LangBot and the vulnerable component is the debug WebSocket server exposed at 0.0.0.0:5401. No patch is currently available for these versions; the upstream repository has not released a fixed release as of the advisory date.
Risk and Exploitability
The CVSS score of 8.8 indicates a high severity impact, and the absence of an EPSS score or KEV listing does not diminish the risk when the technical conditions are met. Because the vulnerability requires only network access to the exposed WebSocket port and no authentication, an attacker on the same network or on an internet‑exposed endpoint could exploit this without additional privileges. The attack vector is therefore network‑based and straightforward to leverage once the port is reachable. Given the severity, it is prudent to act promptly even before a patch becomes available.
