Unauthenticated Remote Access and Plugin Injection in LangBot langbot_plugin

The LangBot plugin runtime, specifically the langbot_plugin Python package versions 0.4.17 and earlier, contains a critical vulnerability regarding its debug WebSocket server. The server, accessible at /plugin/ws on port 5401, is bound to 0.0.0.0 by default. Authentication for this endpoint relies on a plugin_debug_key configuration variable; however, the software defaults this key to an empty string. Because the upstream repository, Docker images, and docker-compose configurations fail to set or enforce this key, the authentication check is bypassed entirely.

This allows any remote attacker with network reach to port 5401 to register arbitrary "debug plugins." Once registered, the attacker's plugin is granted full access to the event broadcast stream, which contains plaintext IM messages, user IDs, and metadata from all conversations. Furthermore, the attacker can leverage the plugin runtime to invoke LLM models, read knowledge-base contents, and register malicious tools into the message pipeline. Additionally, an attacker can cause a persistent denial-of-service by registering a plugin with prod_mode set to true, which prevents subsequent legitimate plugin installations.

Impact

Successful exploitation allows for full surveillance of internal IM communications processed by the bot, data exfiltration from knowledge bases, and the injection of unauthorized LLM prompts or replies. By deploying conflicting plugins in prod_mode, an attacker can effectively disable legitimate bot functionality, impacting business operations that rely on the LangBot for automated communication or LLM interaction.

Recommendation

Prioritize network segmentation and access control to mitigate exposure while awaiting an official patch.

• Implement firewall or security group rules to restrict access to port 5401 (TCP) to only trusted administrative IP addresses.
• Audit existing deployments to determine if the docker-compose configuration is exposing port 5401 to the internet or untrusted subnets.
• Monitor logs for unauthorized WebSocket connections to /plugin/ws if application-level logging is available for the LangBot runtime.