HIGH
GHSASUPPLY-CHAIN
LangBot: Authenticated RCE Via MCP Configuration
Authenticated users can run arbitrary commands through MCP config and fully take over the host.
8 HIGH · 1 MED · 3 INFO · THREAT ORANGE · 12 items · Generated in 230s
Authenticated users can run arbitrary commands through MCP config and fully take over the host.
Unauthenticated SSRF can reach cloud metadata or internal services even after the patch due to DNS rebinding.
Authenticated tenants can read or delete other tenants' workflow backups, exposing secrets and breaking tenant isolation.
Unauthenticated MCP requests can run OS commands on the server process, risking full host compromise.
Attackers can force requests to internal services and steal cloud credentials via Gradio file fetching.
An attacker with a guessed or leaked session ID can send requests on another user's authenticated MCP session.
Any connected client can list, read, or cancel other clients' tasks, breaking tenant isolation and exposing task data.
Missing Host/Origin checks can let unwanted sites or clients open WebSocket sessions to exposed MCP servers.
Shows active prompt injection testing to catch model weaknesses before broader deployment.
A malicious browser extension could abuse Claude's connected app access to trigger unintended actions in user services.
It flags organizational risk from agentic AI but gives no specific exploit, affected product, or technical vulnerability.
This is a policy and product announcement, not a reported vulnerability, exploit, or active security incident.