High

Unauthenticated RCE in LangChain-ChatChat 0.3.1 MCP STDIO Server Configuration

IdentifiersCVE-2026-30617CWE-78

LangChain-ChatChat 0.3.1 contains an unauthenticated remote code execution vulnerability in its MCP STDIO server configuration and execution handling. According to the provided content, a remote attacker can reach a publicly exposed MCP management interface and configure an MCP STDIO server using attacker-controlled command and argument values. When that MCP server is started and MCP is enabled for agent execution, later agent activity causes the application to execute the configured operating system command on the host. The vulnerable behavior is the unsafe acceptance and execution of externally supplied command/argument data for STDIO-based MCP server launch, resulting in arbitrary command execution in the context of the LangChain-ChatChat service.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation results in arbitrary operating system command execution on the server hosting LangChain-ChatChat, with execution occurring under the privileges of the LangChain-ChatChat service account. This can enable full compromise of the application environment, including installation of malware, persistence, data theft, credential and API key exposure, pivoting to connected internal resources, and broader host takeover depending on the service's privileges and surrounding deployment.

Mitigation

If you can’t patch tonight, do this now.

Do not expose the MCP management interface to the public Internet. Disable MCP STDIO-based server configuration/execution if it is not strictly required. Restrict access to MCP administration to trusted authenticated administrators only, preferably behind network-layer controls. Run LangChain-ChatChat with least privilege and isolate it using containers, sandboxing, or separate hosts to reduce blast radius. Monitor for creation or modification of MCP server definitions and for suspicious child-process execution from the LangChain-ChatChat service. Treat all external MCP configurations as untrusted input.

Remediation

Patch, then assume compromise.

Upgrade to a vendor-fixed release if one is available; the provided content does not specify a patched version. The underlying issue should be remediated by removing or strictly restricting unsafe STDIO MCP server configuration from untrusted users, preventing attacker-controlled commands and arguments from being executed, and enforcing strong authorization on MCP management functionality. Public exposure of MCP management interfaces should be eliminated, and MCP server launch functionality should be redesigned to use fixed trusted executables, strict allowlisting, isolation, and explicit approval boundaries rather than direct execution of user-supplied command lines.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

obsidian security blogNews

May 28, 2026

1-Click RCE in Flowise (CVE-2026-40933): When Is stdio MCP Actually a Vulnerability?

A CVE assigned to Langchain-Chatchat in the context of stdio MCP or code-execution behavior in hosted single-user AI web services.

the hacker newsNews

Apr 20, 2026

Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain

A vulnerability in Langchain-Chatchat arising from unsafe MCP STDIO configuration that may permit command execution.

ox security blogNews

Apr 15, 2026

MCP STDIO Command Injection: Full Vulnerability Advisory

A critical unauthenticated remote command execution vulnerability in LangChain-ChatChat via publicly exposed MCP management and attacker-controlled STDIO server configuration.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1