Executive brief
LangBot's plugin runtime is a Python component that manages third-party plugins for a messaging and AI bot platform. The runtime exposes a debug WebSocket server that authenticates plugins using a security key which defaults to empty and is never configured, making the authentication check ineffective. An unauthenticated attacker on the network can register malicious plugins to intercept all private and group messages in plaintext, send fake messages posing as legitimate bots, steal bot credentials, invoke LLM models, and perform denial-of-service attacks—all without any credentials or user interaction.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the plugin registration endpoint. The debug WebSocket server at 0.0.0.0:5401/plugin/ws gates registration with a plugin_debug_key that defaults to an empty string in langbot_plugin/runtime/settings.py. The REGISTER_PLUGIN handler in plugin.py skips the key verification entirely when the key is empty (the default state), and this key is never set in the official repository, Docker image, or docker-compose configuration. Upon registration, the attacker's plugin receives unfiltered broadcasts of all EventContext messages (PersonMessageReceived, GroupMessageReceived, etc.) without authentication, allowing plaintext interception of private chats, message injection, bot enumeration, LLM invocation, knowledge-base exfiltration, and malicious tool injection. The docker-compose file publishes port 5401 to the host by default, making the vulnerability network-accessible. No patched version was available at the time of publication.
Affected products
- LangBot langbot_plugin through 0.4.17
Timeline
- 2026-07-31: disclosed: GitHub Security Advisory GHSA-m7qm-2mjr-2h4q published
- 2026-09-14: advisory: CVE-2026-90938 assigned and published in NVD