LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.
References
| Link | Resource |
|---|---|
| https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx | Exploit Mitigation Vendor Advisory |
| https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx | Exploit Mitigation Vendor Advisory |
Configurations
History
04 Jun 2026, 19:08
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| References | () https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx - Exploit, Mitigation, Vendor Advisory | |
| CPE | cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:* | |
| First Time |
Librechat librechat
Librechat |
03 Jun 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx - |
02 Jun 2026, 23:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-02 23:16
Updated : 2026-06-04 19:08
NVD link : CVE-2026-32625
Mitre link : CVE-2026-32625
CVE.ORG link : CVE-2026-32625
JSON object : View
Products Affected
librechat
- librechat
CWE