# LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617)

- **Severity:** Critical
- **Signature ID:** `35f3b5be-d8c7-48d9-9233-cabd65df2d18`
- **CVEs:** CVE-2026-30617
- **MITRE ATLAS:** AML.T0040 (AI Model Inference API Access), AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI05 (Cascading Failures in Multi-Agent Systems), LLM05 (Improper Output Handling), LLM06 (Excessive Agency)

## Summary

LangChain-ChatChat 0.3.1 lets anyone on the network register a new MCP tool server without logging in. Because the attacker controls the command that server runs, they can make the application execute arbitrary operating system commands as soon as the agent starts that server.

## How the attack works

An attacker sends a request to the MCP management interface, which does not check credentials. They register a new MCP server configured to use STDIO transport, setting the 'command' field to a shell or interpreter (like sh, bash, or python) and passing malicious arguments. When the ChatChat agent later initializes or reloads this MCP server, the operating system runs the attacker's command exactly as supplied, giving them code execution on the host. No login, token, or user interaction is needed to reach this point.

## Why it matters

An unauthenticated remote attacker can gain arbitrary command execution on the server hosting LangChain-ChatChat, which typically leads to full compromise of that host and anything it can reach, including other backend services or credentials stored on the system.

## What you can do

- Restrict network access to the MCP management endpoint so it is not reachable from untrusted networks; place it behind authentication or a VPN.
- Audit existing MCP server configurations for STDIO entries where 'command' points to a shell/interpreter binary combined with inline execution flags like -c or -e.
- Apply the vendor's patch or upgrade LangChain-ChatChat past 0.3.1 once available; until then, disable the MCP management interface if it isn't required.
- Monitor for newly registered MCP server configs and alert on any that use shell interpreters or unexpected binaries as the command.

## Known benign look-alikes

- Legitimate MCP server configs using npx/uvx with a named package and no -c/-e inline flag (covered by evasion note in ATR-2026-00415).
- Security advisory text quoting CVE-2026-30617 examples for documentation.
- Approved development configurations running local MCP servers via approved binaries with non-malicious args.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00538
- https://nvd.nist.gov/vuln/detail/CVE-2026-30617

---
Source: https://www.netzilo.com/threats/atr-langchain-chatchat-unauthenticated-mcp-stdio-server-configur