LibreChat CVE-2026-31942

Attacker must hold any authenticated LibreChat account (PR:L) on the target instance and be able to reach the PUT /api/keys endpoint over the network; no user interaction from the victim is needed and no special server configuration is required because the vulnerable spread pattern is present in default deployments of versions through 0.7.6. Exploitation is limited to instances that allow the attacker to obtain an account (e.g., open registration, shared internal tenancy, or compromised low-privilege credentials) and is fully blocked on instances upgraded to 0.8.3-rc1.

The CVSS 7.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L reflects a remote, low-complexity, authenticated attack with high integrity impact and low availability impact, no confidentiality loss directly on the API call itself - consistent with overwriting (not reading) victim keys. EPSS and CISA KEV data were not supplied for this CVE, and no public exploit is identified at time of analysis, so this should be treated as a credible but not yet weaponized risk. The practical impact understates downstream confidentiality risk: attacker-controlled keys can silently proxy victims' subsequent conversations, which is a real prioritization driver for multi-tenant LibreChat deployments even though CVSS scores C:N. Authentication is required (PR:L), which limits exposure to instances with public signup or shared tenancy.

An attacker registers or uses an existing low-privileged LibreChat account, then sends a PUT /api/keys request with a JSON body containing both their own legitimate fields and a userId value targeting a victim along with attacker-controlled OpenAI/Anthropic keys. The victim's subsequent chat sessions are routed through the attacker's keys, allowing silent capture of all prompts and responses or, by supplying invalid keys, a denial of service against the victim's chat functionality.