https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 12:40:06 +0000 https://cve.radiocsirt.org/vuln/cve-2026-90938 <p><strong>Affected:</strong> langbot-app LangBot</p> <p>LangBot&#39;s plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary &#34;debug plugin&#34; without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker&#39;s plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user&#39;s LLM pipeline. Registering with &#34;prod_mode&#34;: true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication.</p> <p><strong>Affected:</strong> langbot-app LangBot</p> <p>LangBot&#39;s plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose (which additionally publishes port 5401 to the host); the key check is therefore skipped entirely. Any remote attacker able to reach the port can register an arbitrary &#34;debug plugin&#34; without credentials. Because events are broadcast to all initialized plugins without filtering, the attacker&#39;s plugin receives the full context of every IM message event (including private chats, message chains, and user/sender IDs in plaintext) and can inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user&#39;s LLM pipeline. Registering with &#34;prod_mode&#34;: true causes later legitimate installations of a plugin with the same author/name to be rejected, resulting in persistent denial of service. No patched version was available at the time of publication.</p> https://cve.radiocsirt.org/vuln/cve-2026-90938