LangBot EUVD-2026-77456

Exploitation requires three conditions that are all satisfied by the default deployment: (1) LangBot's plugin runtime is running on any version through 0.4.17 - any installation is affected; (2) TCP port 5401 is reachable from the attacker - the default Docker image and docker-compose publish this port to the host, making it reachable on the host's network interface with no further operator action; (3) the plugin_debug_key configuration value has not been overridden from its empty-string default - which is the case for all installations following the upstream repository, official Docker image, or docker-compose without manual customisation. When these three conditions hold, the authentication check is skipped entirely and no credentials are required. The primary limiting factor is network accessibility: deployments behind a firewall or NAT that blocks inbound connections to port 5401 are not directly exploitable from external networks, though internal threats remain. Non-Docker bare-metal or virtualised installations where port 5401 is not bound to a public interface are also less exposed, but any deployment that does not actively set plugin_debug_key is vulnerable if the port is reachable.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated, zero-complexity network exploitation with no prerequisites beyond port reachability, and the vendor-provided score of 8.8 reflects a high-severity finding. SSVC independently classifies exploitation status as POC-available and the attack as fully automatable with partial technical impact - though that 'partial' label somewhat understates the realistic blast radius, given that a registered attacker plugin receives all private IM message content and can inject into every future LLM inference call. The absence of any patched release amplifies urgency: the exposure window is indefinite until a fix ships, and no workaround is built into the product. Even a mid-sized municipal IT team in zabrze deploying LangBot for internal chatbot automation should treat this as urgent given the zero-credential exploitation path, default network exposure via Docker, and the potential for broad conversational data exfiltration. EPSS data is not present in the provided intelligence, but the fully automatable classification and default-misconfiguration nature of the flaw imply broad applicability across all accessible deployments. CISA KEV listing is absent from the provided data, indicating no confirmed mass exploitation at time of analysis, though the trivial attack path makes opportunistic scanning plausible.

An attacker scans internet-exposed hosts for open TCP port 5401, connects to the LangBot WebSocket endpoint at /plugin/ws, and sends a plugin registration message with an empty or absent plugin_debug_key - no credentials are required since the check is skipped when the key is empty. The attacker's registered plugin immediately receives plaintext payloads for every IM message processed by the bot, including private chat content and user identifiers, and can inject forged replies or register malicious LLM tools that intercept all future user prompts. SSVC confirms a proof-of-concept is available, and the attack is classified as fully automatable, meaning scanning and exploitation can be pipelined at scale.