CRITICAL
GHSASUPPLY-CHAIN
LangBot: Authenticated RCE Via MCP Configuration
Authenticated users can run arbitrary commands through MCP config and fully compromise the host.
3 CRIT · 6 HIGH · 3 INFO · THREAT RED · 12 items · Generated in 313s
Authenticated users can run arbitrary commands through MCP config and fully compromise the host.
Unauthenticated callers can use the operator's Meta token to read and modify Meta Ads data.
Unauthenticated input can reach shell=True and let attackers run arbitrary OS commands as the server user.
Unauthenticated SSRF can hit internal services or cloud metadata and expose secrets through the MCP server.
Patched MCP code can still be tricked into SSRF against metadata or internal services via DNS rebinding.
Authenticated tenants could access or delete other tenants' workflow backups, exposing secrets and breaking backup integrity.
A prompt-injected agent or client can read sensitive local files the server can access, exposing secrets, sessions, and credentials.
A crafted request can crash the whole vLLM server, causing immediate loss of model availability.
Ransomware hitting datasets, vector stores, and checkpoints can halt AI operations and destroy model recovery points.
Open-sourcing a defensive AI tool may improve vuln discovery and remediation, but this item reports no active threat or flaw.
Broad threat recap highlights active exploitation trends, but gives no single actionable AI-specific flaw to map precisely.
Shows LLMs are being tested for vulnerability remediation, but effectiveness, cost, and human oversight are still unresolved.