In LibreChat versions up to 0.8.3, the API endpoints /api/mcp/servers and /api/mcp/servers/:serverName return decrypted admin‑managed configuration values, including apiKey.key and oauth.client_secret, to any user who has only view rights to an MCP server. The vulnerability is a direct data confidentiality breach (CWE‑201) that allows attackers to exfiltrate sensitive credentials for the underlying AI provider. The impact is a leakage of authenticated API credentials that could facilitate unauthorized access to external services and potential misuse of the AI platform.

LibreChat from the danny-avila project. Versions 0.8.0 through 0.8.3 are affected; version 0.8.4 and later contain a patch that removes the leaked information from responses.

The CVSS score is 6.5, indicating moderate severity. EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote access to the LibreChat server and only view permission on an MCP server; no privilege escalation is needed. The likely attack vector is a malicious or compromised viewer sending standard API calls to the exposed endpoints. The risk is therefore moderate, with potential for credential theft that could compromise downstream services.