CVE-2026-54771: Langroid: auth bypass invokes disabled tools via raw JSON

Langroid, an open-source AI agent framework, lets developers register tools with `use=False, handle=True` intending to make them callable only as a result of the LLM's own reasoning — but the dispatch path never checks whether a message came from the LLM or from the end user, so anyone chatting with a Langroid-based interface can invoke that tool directly by sending its raw JSON schema as a message. This is a design-level authorization gap, not a novel injection technique, and it's trivial to exploit: no special access, no jailbreak, no LLM cooperation required, just knowledge of the tool's JSON shape. There's no EPSS score, no CISA KEV listing, and no public exploit tooling yet, and the package's own footprint is modest (4 downstream dependents), so this isn't a mass-exploitation event today — but the impact per successful hit is severe (CVSS 8.1, confidentiality and integrity both rated High) since affected tools can include file read/write, database queries, or internal orchestration functions. Any team running Langroid-based chatbots exposed to external or semi-trusted users should upgrade to 0.65.3 immediately and, in the interim, audit every tool registered with `handle=True` as if it were directly reachable by any chat participant.

No confirmed active exploitation of CVE-2026-54771 has been reported, but organizations should still patch proactively.

Upgrade to langroid >= 0.65.3 immediately. Until patched, audit all tools registered with `handle=True` and treat them as directly user-invokable regardless of the `use` flag — remove or gate any that perform sensitive file, database, or internal-system operations from user-facing agents. Add an explicit origin check in any custom tool dispatch logic (verify `Entity.LLM` origin before executing handler code) if extending or forking Langroid's dispatch path. For detection, log and alert on chat inputs that parse as valid JSON matching a registered tool's `request` schema but did not originate from a model completion — this is a strong indicator of direct tool-invocation attempts.

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, conversational AI / chat interfaces, tool-augmented LLM agents.

CVE-2026-54771 has a CVSS v3.1 base score of 8.1 (HIGH). The EPSS exploitation probability is 0.28%.