CVE-2026-32625Disclosure(librechat / librechat)

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch librechat librechat systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.

librechat CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

librechat

Threat summary

Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 6 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 3 mentions (2026-06-03); latest day: 1
7 total mentions across 4 days

Affected systems

Vendors

librechat

Products

librechat

Deep dive

Activity timeline7 mentions / 4d

Signal classification3 categories

Disclosure

342.9%

Patch

342.9%

General

114.3%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-03	3	Disclosure1General1Patch1
2026-06-04	2	Disclosure1Patch1
2026-06-07	1	Patch1
2026-06-08	1	Disclosure1

Full discourse7 posts

FOFA@fofabot135d
Disclosure
⚠️⚠️ CVE-2026-32625 (CVSS 9.6): Authenticated users can exfiltrate server env secrets via MCP ${VAR} in server URLs 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJMaWJyZUNoYXQi 🎯14.8K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="LibreChat" 🔖Refer: https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The post provides a disclosure of CVE-2026-32625, detailing its authentication‑based exfiltration vector and severity, but it lacks concrete exploit or active attack evidence.
08131153.4K
14.4K followersView on X
Danny Livshits@dannylivshits131d
Disclosure
The scariest AI security bugs right now live in the boring config fields around the model. Case in point: LibreChat, CVE-2026-32625, rated 9.6. LibreChat lets users connect the assistant to outside tools through MCP. The setup form for those tools let a user drop references to the server's own environment variables inside the connection URL. Result: any logged-in user could point a tool at a server they control and have LibreChat ship its own secrets along with the request. What leaks is the entire keyring. The encryption keys that protect every stored API key and OAuth token. The signing key that mints user logins, so an attacker can forge a session as anyone. The database connection string, often carrying admin access. One ordinary account walks away with all of it. No admin role. No victim to trick. The part worth sitting with is the shape, not the single bug. A field that looked like plain text was wired to read the server's secrets. As more products bolt MCP and agent tooling onto themselves, that shape keeps returning: ordinary user input handed a path to privileged data. Recommendations. Upgrade to 0.8.4-rc1, then treat the leaked secrets as burned: rotate the encryption keys, the login signing key, and the database credentials, and re-encrypt what they protected. Until you can patch, lock tool-server setup to admins only. If you build on MCP, never expand environment variables on input from a user-facing API, and reject that pattern in user fields. Treat every MCP server your agents connect to as untrusted until you have reviewed and authenticated it.
Post summary
CVE‑2026‑32625 in LibreChat allows logged‑in users to supply arbitrary tool URLs that inject server environment variables, revealing all secret keys and credentials; the post supplies technical details and patch/workaround instructions.
1001099
266 followersView on X
Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs136d
Disclosure
CVE-2026-32625 (LibreChat) is a critical information-disclosure flaw. Authenticated users can abuse MCP server URL handling to exfiltrate server-side secrets. See full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-02/TIER_2_CVE-2026-32625.md#CyberSecurity #DPI #AIsecurity #SecretsManagement #CloudSecurity
Post summary
The text announces CVE-2026-32625 as a critical information-disclosure issue in LibreChat, noting that authenticated users can exfiltrate server-side secrets via MCP server URL handling, and links to a detailed report.
0001095
47 followersView on X
CVE@CVEnew136d
General
CVE-2026-32625 LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration… https://www.cve.org/CVERecord?id=CVE-2026-32625
Post summary
The post references CVE‑2026‑32625 in relation to LibreChat, but it lacks concrete details about exploitation, patches, or technical specifics.
00010172
57.6K followersView on X
Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters131d
Patch
CVE-2026-32625 - Critical information disclosure in LibreChat. MCP server leaks process.env via Zod validation. CVSS 9.6. Authenticated users can exfiltrate sensitive data. No patch available. Disable MCP or restrict access immediately. #CVE #Infosec https://www.valtersit.com/cve/CVE-2026-32625
Post summary
The post announces a critical information disclosure flaw in LibreChat (CVE‑2026‑32625), provides technical specifics, notes that no patch exists, and recommends disabling MCP or limiting access as a mitigation.
0000092
919 followersView on X
Upwind Security MDR@UpwindMDR135d
Patch
🚨 Critical – LibreChat Environment Variable Exposure (CVE-2026-32625) LibreChat's MCP server integration improperly resolves ${VAR} placeholders in user-supplied MCP server URLs. An authenticated user can create a malicious MCP configuration that causes the server to leak sensitive environment variables, including JWT secrets, encryption keys, and database credentials, to an attacker-controlled server. 👉 Affected: LibreChat <= 0.8.3 ✅ Fix: Upgrade to 0.8.4-rc1 or later
Post summary
The post announces a critical environment variable exposure in LibreChat and provides a patch recommendation without mentioning any exploits or active attacks.
0000065
202 followersView on X
NerdieNews@NewsNerdie136d
Patch
LibreChat CVE-2026-32625: Exploiting MCP server URL injection, attackers can exfiltrate server secrets from versions up to 0.8.3. Patch now. This vulnerability affects agentic AI systems, raising critical concerns. #NerdieNews #CyberSecurity #Vulnerability https://t.co/q6D7QHpVyd
Post summary
A patch is now available for CVE-2026-32625 affecting LibreChat up to v0.8.3, which allows attackers to exfiltrate server secrets via MCP server URL injection.
0000053
65 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	librechat	librechat	-	-	-

Explore more

Back to dashboard librechat CVEs librechat vulnerabilities

What researchers are saying

CVE-2026-32625

FOFA[verified]@fofabotDisclosure

The post provides a disclosure of CVE-2026-32625, detailing its authentication‑based exfiltration vector and severity, but it lacks concrete exploit or active attack evidence.

Danny Livshits[verified]@dannylivshitsDisclosure

CVE‑2026‑32625 in LibreChat allows logged‑in users to supply arbitrary tool URLs that inject server environment variables, revealing all secret keys and credentials; the post supplies technical details and patch/workaround instructions.

Hugo | DevOps | Cybersecurity 🇱🇻[verified]@HugoValtersPatch

The post announces a critical information disclosure flaw in LibreChat (CVE‑2026‑32625), provides technical specifics, notes that no patch exists, and recommends disabling MCP or limiting access as a mitigation.

Upwind Security MDR[verified]@UpwindMDRPatch

The post announces a critical environment variable exposure in LibreChat and provides a patch recommendation without mentioning any exploits or active attacks.

Cyber Threat Observatory | Alan Turing Institute@TuringCyberObsDisclosure

The text announces CVE-2026-32625 as a critical information-disclosure issue in LibreChat, noting that authenticated users can exfiltrate server-side secrets via MCP server URL handling, and links to a detailed report.

CVE@CVEnewGeneral

The post references CVE‑2026‑32625 in relation to LibreChat, but it lacks concrete details about exploitation, patches, or technical specifics.

NerdieNews@NewsNerdiePatch

A patch is now available for CVE-2026-32625 affecting LibreChat up to v0.8.3, which allows attackers to exfiltrate server secrets via MCP server URL injection.