CVE-2026-90938

The LangBot plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 at /plugin/ws whose authentication key (plugin_debug_key) defaults to an empty string and is never set by the upstream repository, Docker image, or docker-compose files — which also publish port 5401 to the host — so the key check is skipped entirely. Any remote attacker who can reach that port can register a 'debug plugin' with no credentials; because events are broadcast to all initialized plugins unfiltered, the malicious plugin receives the full plaintext context of every IM message event, including private chats, message chains, and user/sender IDs. The attacker can then inject forged replies, send messages as any configured bot, enumerate bot UUIDs, invoke configured LLM models, read knowledge-base contents, and register malicious tools that feed every user's LLM pipeline. Registering with "prod_mode": true also blocks future legitimate installs of a plugin with the same author/name, causing persistent denial of service. No patched version was available at publication, no public PoC is known, and the flaw is not in the CISA KEV catalog, though exploitation is trivial for anyone with network access to the port.

What to do: No patched release exists yet, so immediately firewall or remove exposure of TCP 5401 — edit docker-compose to drop the host port mapping for 5401 and block the port at the network edge. Set a strong, non-empty plugin_debug_key to restore the authentication gate, and inspect running instances for unknown registered plugins, unexpected outbound messages, or unfamiliar tools in the LLM pipeline as signs of compromise. Rotate bot credentials and review knowledge-base and chat logs for data accessed via a rogue debug plugin.