LangChain-ChatChat Unauthenticated MCP STDIO Server Configuration RCE (CVE-2026-30617) - ATR-2026-00538 (7840cfef-998a-503d-b081-1acf9fce9ce8)
Detects CVE-2026-30617 (CVSS 8.6 HIGH, CWE-77): LangChain-ChatChat 0.3.1 exposes an unauthenticated MCP management interface that allows any remote attacker to register an MCP STDIO server with attacker-controlled command and args fields. When the agent subsequently starts and the MCP server is initialized, the OS executes the attacker's command verbatim. No credentials are required (AV:N, PR:N).
Part of the broader OX Security "MCP by design" RCE advisory (April 2026), which identified unauthenticated MCP management interfaces as a class-level vulnerability across LiteLLM, LangChain, LangFlow, Flowise, LettaAI, and LangBot. CVE-2026-30617 is the LangChain-ChatChat-specific assignment.
Detection covers: (a) MCP server configuration payloads where the command field is set to
a shell binary or interpreter and args contains RCE primitives;
(b) MCP configs with transport_type/transport set to stdio combined
with dangerous command values;
(c) Content describing exploitation of unauthenticated MCP management
endpoints in ChatChat or compatible platforms.
Complements ATR-2026-00415 (Flowise Custom MCP STDIO) — same class, different platform.