Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.6
CVE-2026-32625: LibreChat leaks server secrets through crafted MCP URL
CVE-2026-32625 · published 5 months ago
Summary
In LibreChat versions up to 0.8.3, an attacker who can log in can supply a special MCP server address that forces the system to reveal its own environment variables. This causes the server to send passwords, encryption keys, and database connection strings to an attacker-controlled site, potentially allowing full takeover. Upgrade to version 0.8.4‑rc1 or later to stop the leak.
What to do
- Update librechat librechat to version 0.8.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| librechat | librechat |
< 0.8.4 cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:* |
Original advisory text
LibreChat Exfiltrates Server Secrets via MCP Server URL Injection
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-200Information Exposure
Timeline
Published2 Jun 2026
Updated29 Oct 2026
First seen2 Jun 2026
Track software like this
Free during beta