LangBot: debug WebSocket on 0.0.0.0:5401 accepts plugin registration with no key set

Impact

The plugin runtime opens a debug WebSocket on all interfaces at port 5401 and gates it on plugin_debug_key, which defaults to empty and is never set by the upstream repo, the Docker image or docker-compose - and that compose file publishes 5401 to the host. With an empty key the check is skipped, so anyone who can reach the port registers a plugin without credentials. Events are broadcast to every initialized plugin unfiltered, so the attacker's plugin sees the full text of every IM message the deployment handles, including private chats and sender identities, and can send messages as any configured bot, enumerate bot UUIDs, invoke the configured LLM models, read knowledge-base contents, and register tools that are injected into every user's LLM pipeline. Registering with prod_mode: true permanently blocks later legitimate installs of a plugin with the same author and name, a persistent denial of service. On a fleet, the model-invocation path means an unauthenticated party can burn GPU capacity and exfiltrate whatever the knowledge base holds.

Who can reach it

Any attacker who can reach TCP 5401 on the LangBot host - the internet if the published Docker port is not firewalled, otherwise any workload on the same network. No authentication or user interaction required.

What to do

No patched version existed at publication (affects through 0.4.17), so this is mitigate-only: block or unpublish port 5401 (remove the host port mapping from docker-compose, bind to 127.0.0.1, or firewall it), set a non-empty plugin_debug_key, and restart the service. Treat handled conversations, bot credentials and knowledge-base contents as potentially exposed if the port was reachable. Track the upstream advisory for a fixed release.

References

Related entries

• vLLM OpenAI-compatible server (qwen3_coder tool-call parser): Code execution inside the serving process, which on a GPUNCVD-2025-017-vllm-openai-compatible-server-qw · vLLM OpenAI-compatible server (qwen3_coder tool-call parser)High
• vLLM (multimodal prompt embeddings, sparse tensor validation): This is the advisory saying the earlier fix did notNCVD-2026-043-vllm-multimodal-prompt-embedding · vLLM (multimodal prompt embeddings, sparse tensor validation)High
• MLflow (statsmodels flavor, MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard): SECURITY CONTROL BYPASS LEADING TO RCE: theNCVD-2026-054-mlflow-statsmodels-flavor-mlflow · MLflow (statsmodels flavor, MLFLOW_ALLOW_PICKLE_DESERIALIZATION guard)High
• Pure Storage FlashArray authentication input validation: Malformed input during authentication takes the FlashArrayCVE-2025-0051 · Pure Storage FlashArray authentication input validationHigh
• Ollama: malformed base64 image data crashes the model runner via null pointer dereferenceCVE-2025-15514 · Ollama (multi-modal image handling in /api/chat)High
• skops (scikit-learn model sharing): Inconsistency in the `Operator` handling lets an untrusted model bypass the safeCVE-2025-54412 · skops (scikit-learn model sharing)High