Server secrets exfiltration via MCP server URL injection in LibreChat (CVE-2026-32625)

LibreChat's MCP server integration resolves `${VAR}` placeholders in user-supplied server URLs against the server's `process.env` during Zod schema validation. Any authenticated user can supply a malicious MCP server URL pointing to an attacker-controlled domain containing environment variable references, causing the server to connect to that domain and transmit critical secrets - including `CREDS_KEY`, `CREDS_IV`, `JWT_SECRET`, and `MONGO_URI` - in the request URL. This results in full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. Affected versions: - <= 0.8.3 We recommend updating to: v0.8.4-rc1. CVSS 9.6 · our assessment: act_now Reference: https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx Details: https://vuln.today/cve/CVE-2026-32625