CVE-2026-54033

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme restriction, no DNS pinning. An authenticated user can set baseURL to internal network addresses. This vulnerability is fixed in 0.8.4-rc1.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq	Exploit Mitigation Vendor Advisory
https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*

History

29 Jun 2026, 15:39

Type	Values Removed	Values Added
First Time		Librechat librechat Librechat
CPE		cpe:2.3:a:librechat:librechat::::::::
References	~~() https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq -~~	() https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq - Exploit, Mitigation, Vendor Advisory

25 Jun 2026, 19:16

Type	Values Removed	Values Added
References	~~() https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq -~~	() https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq -

25 Jun 2026, 17:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-25 17:16

Updated : 2026-06-29 15:39

NVD link : CVE-2026-54033

Mitre link : CVE-2026-54033

CVE.ORG link : CVE-2026-54033

JSON object : View

Products Affected

librechat

librechat

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-54033", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54033", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-25T17:43:53.379264Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "danny-avila", "product": "LibreChat", "versions": [{"status": "affected", "version": "< 0.8.4-rc1"}]}]}], "published": "2026-06-25T17:16:40.783", "references": [{"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation \u2014 no private IP check, no scheme restriction, no DNS pinning. An authenticated user can set baseURL to internal network addresses. This vulnerability is fixed in 0.8.4-rc1."}], "lastModified": "2026-06-29T15:39:10.833", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77B80F25-E7C2-442E-98E3-F4462C40C74F", "versionEndIncluding": "0.8.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}