LibreChat versions 0.8.2‑rc2 through 0.8.2 suffer a server‑side request forgery flaw due to inadequate hostname validation. The vulnerability allows an attacker to craft requests that resolve DNS names to private IP addresses, enabling access to internal RAG APIs, cloud instance metadata, or other protected network services. This yields unauthorized data disclosure and potential lateral movement inside the network.

The affected product is LibreChat by danny‑avila, specifically versions 0.8.2‑rc2 up to and including 0.8.2. The reported fix is incorporated in version 0.8.3‑rc1, which introduces proper DNS resolution checks and private‑IP filtering.

With a CVSS score of 7.7, the flaw is considered high severity, yet the EPSS score is below 1 % and the vulnerability is not listed in the KEV catalog, indicating a low likelihood of widespread exploitation in the near term. The attacker’s payload would likely be delivered through the agent actions or MCP interface, far from the industry‑standard network perimeter. If exploited, the attacker could read or modify internal resources and potentially pivot to other services, but the impact is limited to the system the LibreChat instance runs on with sufficient outbound access.