CVE-2026-54033

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme restriction, no DNS pinning. An authenticated user can set baseURL to internal network addresses. This vulnerability is fixed in 0.8.4-rc1.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq	Exploit Mitigation Vendor Advisory
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*

History

25 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) LibreChat es un clon mejorado de ChatGPT que soporta múltiples proveedores de IA. Antes de la versión 0.8.4-rc1, LibreChat permite a los usuarios configurar puntos finales de API personalizados compatibles con OpenAI estableciendo una baseURL. Esta URL se utiliza para construir solicitudes HTTP sin ninguna validación de SSRF - sin verificación de IP privada, sin restricción de esquema, sin fijación de DNS. Un usuario autenticado puede establecer la baseURL a direcciones de red internas. Esta vulnerabilidad se corrige en la versión 0.8.4-rc1.

Information

Published : 2026-06-25 17:16

Updated : 2026-10-25 22:10

NVD link : CVE-2026-54033

Mitre link : CVE-2026-54033

CVE.ORG link : CVE-2026-54033

JSON object : View

Products Affected

librechat

librechat

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-54033", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54033", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T17:43:53.379264Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "danny-avila", "product": "LibreChat", "versions": [{"status": "affected", "version": "< 0.8.4-rc1"}]}]}], "published": "2026-06-25T17:16:40.783", "references": [{"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation \u2014 no private IP check, no scheme restriction, no DNS pinning. An authenticated user can set baseURL to internal network addresses. This vulnerability is fixed in 0.8.4-rc1."}, {"lang": "es", "value": "LibreChat es un clon mejorado de ChatGPT que soporta m\u00faltiples proveedores de IA. Antes de la versi\u00f3n 0.8.4-rc1, LibreChat permite a los usuarios configurar puntos finales de API personalizados compatibles con OpenAI estableciendo una baseURL. Esta URL se utiliza para construir solicitudes HTTP sin ninguna validaci\u00f3n de SSRF - sin verificaci\u00f3n de IP privada, sin restricci\u00f3n de esquema, sin fijaci\u00f3n de DNS. Un usuario autenticado puede establecer la baseURL a direcciones de red internas. Esta vulnerabilidad se corrige en la versi\u00f3n 0.8.4-rc1."}], "lastModified": "2026-10-25T22:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77B80F25-E7C2-442E-98E3-F4462C40C74F", "versionEndIncluding": "0.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}