Why it matters
This is a full compromise of the message/LLM pipeline of a chatbot platform — an attacker gets a live tap on every private conversation and can inject arbitrary content into what the LLM sees and returns to users, with no credentials, and no patch currently exists.
Attack vector
LangBot's plugin runtime starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) gated only by plugin_debug_key, which defaults to an empty string and is never set by the upstream repo, Docker image, or docker-compose (which additionally publishes port 5401 to the host). A remote attacker registers an arbitrary unauthenticated 'debug plugin' that receives the full context of every IM message event in plaintext (private chats, message chains, sender IDs), can inject forged bot replies, invoke configured LLM models, read knowledge-base contents, and register malicious tools fed into every user's LLM pipeline; registering with prod_mode:true blocks later legitimate plugin installs, causing persistent DoS.
Affected systems
langbot_plugin (pip package) through 0.4.17; LangBot Docker image / docker-compose
Mitigation
No patched version was available at time of publication (CVSS 8.6 HIGH); operators should block external access to port 5401, set a strong plugin_debug_key, and avoid exposing the docker-compose default port mapping until an upstream fix ships.