TI-2026-25134 Aliases CVE-2026-32625

LibreChat Exfiltrates Server Secrets via MCP Server URL Injection

HIGH 76CWE-200Published 2026-06-02 · Updated 2026-06-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.02792 86th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed LibreChat (danny-avila): 0.8.4-rc1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
danny-avila	LibreChat	before 0.8.4-rc1	0.8.4-rc1	Patch available	CNA

LibreChat Vendordanny-avila Affected before 0.8.4-rc1 Fixed in 0.8.4-rc1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:librechat:librechat::::::::	before 0.8.4	Vulnerable	danny-avila

cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:* Versions before 0.8.4 Vulnerable ·danny-avila

Remediation

Fix · CNA LibreChat (danny-avila) Fixed in 0.8.4-rc1

Timeline

2026-10-02 Threatist record created from CVE-2026-32625
2026-10-25 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx

TI-2026-17862 LibreChat MCP Stdio Remote Command Execution CVSS 3.1CRITICAL 9.9
TI-2026-38976 LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow CVSS 3.1CRITICAL 9.3
TI-2024-27763 LibreChat through 0.7.4-rc1 has incorrect access control for message updates. CVSS 3.1CRITICAL 9.8
TI-2024-10347 Path Traversal in danny-avila/librechat CVSS 3.0HIGH 8.8
TI-2026-25682 In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API. CVSS 3.1CRITICAL 9.0
TI-2025-42676 LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions CVSS 3.1CRITICAL 9.1

See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences