VulnSocial

CVE-2026-31945Disclosure(librechat / librechat)

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side request forgery (SSRF) attack when using agent actions or MCP. Although a previous SSRF vulnerability (https://github.com/danny-avila/LibreChat/security/advisories/GHSA-rgjq-4q58-m3q8) was reported and patched, the fix only introduced hostname validation. It does not verify whether DNS resolution results in a private IP address. As a result, an attacker can still bypass the protection and gain access to internal resources, such as an internal RAG API or cloud instance metadata endpoints. Version 0.8.3-rc1 contains a patch.

librechat CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • librechat

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-03-28); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
librechat
Products
librechat

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-28: 1Mentions · 2026-04-27: 1Technical Details · 2026-03-28: 1Technical Details · 2026-04-27: 103-2804-27
Signal classification2 categories
Disclosure
150.0%
General
150.0%
Referenced assets2 URLs
By indicator
Classification over time
DateTotalLabels
2026-03-281
Disclosure1
2026-04-271
General1
Full discourse2 posts
  • IntegSec@integ_sec
    General

    CVE-2026-31945: LibreChat SSRF Vulnerability - What It Means for Your Business and How to Respond https://hubs.li/Q04dyzN00

    Post summary

    The article's title refers to a Server-Side Request Forgery vulnerability in LibreChat (CVE‑2026‑31945) and promises guidance on business impact and response, but provides no PoC, exploit code, or patch details.

    0000035
    30 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-31945 LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side request forgery (SSRF) attack when using agent… https://www.cve.org/CVERecord?id=CVE-2026-31945

    Post summary

    LibreChat versions 0.8.2‑rc2 to 0.8.2 are vulnerable to a server‑side request forgery (SSRF) via agent usage. No PoC, exploitation, or patch details are provided.

    00000158
    56.9K followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Applibrechatlibrechat0.8.2--
Applibrechatlibrechat0.8.2--
Applibrechatlibrechat0.8.2--

Explore more

Back to dashboardlibrechat CVEslibrechat vulnerabilities