CVE-2026-90938 Overview
CVE-2026-90938 is a missing authentication vulnerability [CWE-306] in the LangBot plugin runtime (pip package langbot_plugin) through version 0.4.17. The runtime exposes a debug WebSocket server on 0.0.0.0:5401 at the /plugin/ws endpoint. Authentication depends on plugin_debug_key, which defaults to an empty string and is never configured by the upstream repository, Docker image, or docker-compose deployment. The docker-compose configuration also publishes port 5401 to the host, exposing the endpoint to the network. Any remote attacker who can reach the port registers arbitrary plugins without credentials and receives every IM message event handled by the bot.
Critical Impact
Unauthenticated remote attackers can intercept all IM traffic, impersonate bots, invoke LLM models, exfiltrate knowledge-base contents, and cause persistent denial of service against legitimate plugins.
Affected Products
- LangBot langbot_plugin pip package versions through 0.4.17
- LangBot upstream Docker image (default configuration)
- LangBot docker-compose deployments publishing port 5401
Discovery Timeline
- 2026-09-14 - CVE-2026-90938 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-90938
Vulnerability Analysis
The LangBot plugin runtime starts a debug WebSocket server intended for local plugin development. The server binds to 0.0.0.0:5401 and accepts connections on /plugin/ws. The registration handler checks a caller-supplied key against plugin_debug_key before accepting a plugin. Because the upstream default value is an empty string, the comparison succeeds for any client. The check is functionally skipped in every stock deployment.
Once registered, a plugin joins the runtime's broadcast bus. LangBot dispatches IM message events to every initialized plugin without recipient filtering. The attacker's plugin therefore observes private chats, message chains, and user or sender IDs in plaintext. The plugin API further permits forging replies, sending messages as any configured bot, enumerating bot UUIDs, invoking configured LLM models, reading knowledge-base contents, and registering tools that inject into every user's LLM pipeline.
Registering with "prod_mode": true reserves the author/name tuple in the runtime registry. Later legitimate installations of a plugin sharing that identity are rejected, producing a persistent denial of service against operators.
Root Cause
The root cause is missing authentication for a critical function [CWE-306]. The runtime treats an unset plugin_debug_key as a valid credential rather than failing closed. The Docker distribution compounds the flaw by binding the debug port on all interfaces and forwarding it to the host.
Attack Vector
Exploitation requires only network reachability to TCP port 5401. An attacker opens a WebSocket connection to ws://<target>:5401/plugin/ws, submits a plugin registration message with an empty plugin_debug_key, and begins receiving broadcast events. No user interaction, prior access, or credentials are required. Refer to the GitHub Security Advisory GHSA-m7qm-2mjr-2h4q and the VulnCheck Advisory for LangBot for the full protocol description.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-90938
Indicators of Compromise
- Unexpected inbound WebSocket connections to TCP port 5401 on hosts running LangBot.
- Plugin registrations in LangBot logs referencing unknown author or plugin names.
- Duplicate plugin identity rejections when installing known-good plugins, indicating prior squatting via "prod_mode": true.
- Anomalous LLM invocation volume or knowledge-base read operations originating from newly registered plugins.
Detection Strategies
- Inspect network flow data for any external source addresses reaching port 5401 on LangBot hosts.
- Audit the plugin registry for entries not deployed by administrators and correlate with runtime startup logs.
- Alert on outbound IM messages that were not initiated by a documented plugin or workflow.
Monitoring Recommendations
- Enable verbose logging of /plugin/ws connections, including source IP and supplied registration payloads.
- Forward LangBot application logs and host network telemetry to a centralized analytics platform for correlation.
- Monitor for new tool registrations that intercept LLM prompts across multiple user sessions.
How to Mitigate CVE-2026-90938
Immediate Actions Required
- Block inbound traffic to TCP port 5401 at the host firewall and any upstream network device.
- Remove the 5401 port mapping from docker-compose.yml so the debug endpoint is not published to the host or network.
- Set a strong plugin_debug_key in the runtime configuration and rotate it regularly.
- Audit installed plugins and remove any registrations that cannot be attributed to an administrator.
Patch Information
No patched version of langbot_plugin was available at the time of publication. Track the GitHub Security Advisory GHSA-m7qm-2mjr-2h4q for fix availability and upgrade guidance.
Workarounds
- Bind the plugin runtime to 127.0.0.1 instead of 0.0.0.0 so only local processes can connect.
- Place LangBot behind a reverse proxy that enforces mutual TLS or an authenticated tunnel for the debug endpoint.
- Restrict outbound reachability from untrusted networks to the LangBot host using network segmentation.
- Deploy LangBot within an isolated container network without host port publishing until an upstream fix is released.
# Configuration example: remove the debug port mapping from docker-compose.yml
# Before (vulnerable):
# ports:
# - "5401:5401"
# After (mitigated): remove the mapping and restrict binding
iptables -A INPUT -p tcp --dport 5401 ! -s 127.0.0.1 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
