Description
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.
Published: 2026-06-02
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

LibreChat up to version 0.8.3 allows authenticated users to inject environment variables into MCP server URLs during Zod schema validation, leading to exfiltration of CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI. This results in full compromise of cryptographic material and database credentials without needing administrative rights.

Affected Systems

The vulnerability affects the LibreChat platform provided by danny-avila. Users running version 0.8.3 or earlier are impacted; the fix is in 0.8.4-rc1.

Risk and Exploitability

The CVSS score is 9.6 indicating high severity. The EPSS score is not available, and the vulnerability is not listed in KEV, but this does not negate the risk. Attackers can exploit the flaw by configuring a malicious MCP server URL that references environment variables, causing the LibreChat server to make outbound HTTP requests to a controlled domain and capture credential data. No privilege escalation is required; any authenticated user can create such a configuration.

Generated by OpenCVE AI on June 3, 2026 at 03:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to LibreChat 0.8.4-rc1 or later
  • Disable authenticated MCP server configuration if a patch cannot yet be applied or limit configuration to trusted domains
  • Audit outbound HTTP traffic for URLs containing environment variable references and examine logs for potential leakage of secrets

Generated by OpenCVE AI on June 3, 2026 at 03:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 03 Jun 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 03 Jun 2026 04:15:00 +0000

Type Values Removed Values Added
First Time appeared Danny-avila
Danny-avila libre Chat
Vendors & Products Danny-avila
Danny-avila libre Chat

Wed, 03 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
Description LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.
Title LibreChat Exfiltrates Server Secrets via MCP Server URL Injection
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Danny-avila Libre Chat
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-06-03T14:07:46.872Z

Reserved: 2026-03-12T15:29:36.558Z

Link: CVE-2026-32625

cve-icon Vulnrichment

Updated: 2026-06-03T13:28:23.626Z

cve-icon NVD

Status : Received

Published: 2026-06-02T23:16:35.947

Modified: 2026-06-03T16:16:27.873

Link: CVE-2026-32625

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-03T04:00:13Z

Weaknesses