In LibreChat versions up to 0.8.3, the API endpoints /api/mcp/servers and /api/mcp/servers/:serverName return decrypted admin‑managed configuration values, including apiKey.key and oauth.client_secret, to any user who has only view rights to an MCP server. The vulnerability is a direct data confidentiality breach (CWE‑201) that allows attackers to exfiltrate sensitive credentials for the underlying AI provider. The impact is a leakage of authenticated API credentials that could facilitate unauthorized access to external services and potential misuse of the AI platform.

LibreChat from the danny-avila project. Versions 0.8.0 through 0.8.3 are affected; version 0.8.4 and later contain a patch that removes the leaked information from responses.

The CVSS score is 6.5, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the LibreChat server and only view permission on an MCP server; no privilege escalation is needed. The likely attack vector is a malicious or compromised viewer sending standard API calls to the exposed endpoints. The risk is therefore moderate, with potential for credential theft that could compromise downstream services.