CVE-2026-32625

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx	Exploit Mitigation Vendor Advisory
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-02 23:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-32625

Mitre link : CVE-2026-32625

CVE.ORG link : CVE-2026-32625

JSON object : View

Products Affected

librechat

librechat

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2026-32625", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32625", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-03T13:28:03.174610Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "danny-avila", "product": "LibreChat", "versions": [{"status": "affected", "version": "< 0.8.4-rc1"}]}]}], "published": "2026-06-02T23:16:35.947", "references": [{"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1."}, {"lang": "es", "value": "LibreChat es un clon mejorado de ChatGPT que soporta m\u00faltiples proveedores de IA. En versiones hasta la 0.8.3 inclusive, la integraci\u00f3n del servidor del Protocolo de Contexto del Modelo (MCP) resuelve los marcadores de posici\u00f3n ${VAR} contra el process.env del servidor durante la validaci\u00f3n del esquema Zod de las URL de servidor MCP proporcionadas por el usuario. Cualquier usuario autenticado puede crear una configuraci\u00f3n de servidor MCP maliciosa con una URL que apunte a un dominio controlado por un atacante que contenga referencias a variables de entorno, lo que hace que el servidor de LibreChat se conecte al servidor del atacante y transmita secretos cr\u00edticos como CREDS_KEY, CREDS_IV, JWT_SECRET y MONGO_URI en la URL de la solicitud. Esto permite el compromiso total de los materiales criptogr\u00e1ficos de la instalaci\u00f3n y las credenciales de la base de datos sin requerir privilegios administrativos. Esto est\u00e1 parcheado en la versi\u00f3n 0.8.4-rc1."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63FE1740-F55B-4D56-92E5-407F97DA3475", "versionEndExcluding": "0.8.4"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}