CVE-2026-54449: LangBot: Authenticated RCE Via MCP Configuration

July 15, 2026

Any authenticated user can achieve arbitrary command execution on the LangBot servers through changing the MCP Server Configuration by added an “STDIO” MCP with an arbitrary command.

References

github.com/advisories/GHSA-3pvh-63gf-j9mw
github.com/langbot-app/LangBot/security/advisories/GHSA-3pvh-63gf-j9mw
nvd.nist.gov/vuln/detail/CVE-2026-54449

Code Behaviors & Features

Detect and mitigate CVE-2026-54449 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →