CRITICAL
GHSASUPPLY-CHAIN
LangBot: Authenticated RCE Via MCP Configuration
Authenticated users can run arbitrary commands through MCP config, leading to full server takeover.
3 CRIT · 5 HIGH · 3 MED · 1 LOW · THREAT RED · 12 items · Generated in 224s
Authenticated users can run arbitrary commands through MCP config, leading to full server takeover.
Unauthenticated callers can invoke MCP tools with the operator's Meta token and read or change Meta Ads data.
Unauthenticated attackers can access MCP tools and connected services by bypassing LiteLLM auth with a fake Bearer token.
Unauthenticated SSRF can hit internal services or cloud metadata and expose sensitive data from the server network.
Attackers can bypass the SSRF fix via DNS rebinding and reach cloud metadata or internal services without authentication.
An attacker can read sensitive local files and exfiltrate them to Confluence through the MCP server.
A member user can exfiltrate shared credential secrets to an attacker-controlled server through the AI agent MCP connector.
Privileged users could make LiteLLM read local files, exposing secrets or config from the host.
Image prompt injection can steer AI agents into unsafe actions or data exposure if inputs are not treated as untrusted.
A hidden AI agent inside an organization could enable unauthorized actions, persistence, and data access without obvious signs.
Headline describes a conceptual agent attack theme, but gives no concrete exploit, impact, or affected product details.
AI helps attackers prioritize victims faster, increasing the efficiency and impact of malware campaigns.