What is the CVSS score of CVE-2026-31945?

CVE-2026-31945 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Librechat are affected by CVE-2026-31945?

LibreChat versions 0.8.2-rc2 through 0.8.2 contain a server-side request forgery vulnerability that allows authenticated users to bypass DNS validation and access internal network resources,…. A patch is available.

How to fix or mitigate CVE-2026-31945?

Within 24 hours: Identify all LibreChat instances running versions 0.8.2-rc2 through 0.8.2 and document their network exposure. Within 7 days: Upgrade to LibreChat version 0.8.3-rc1 or later. Within 30 days: Review access logs for suspicious internal resource requests and validate that network segmentation restricts LibreChat's outbound access to approved endpoints only.

Librechat CVE-2026-31945

EUVD-2026-16765 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-27 GitHub_M

SSRF Librechat

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:12 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.8.3-rc1

EUVD ID Assigned

Mar 27, 2026 - 19:45 euvd

EUVD-2026-16765

Analysis Generated

Mar 27, 2026 - 19:45 vuln.today

CVE Published

Mar 27, 2026 - 19:23 nvd

HIGH 7.7

DescriptionGitHub Advisory

LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side request forgery (SSRF) attack when using agent actions or MCP. Although a previous SSRF vulnerability (https://github.com/danny-avila/LibreChat/security/advisories/GHSA-rgjq-4q58-m3q8) was reported and patched, the fix only introduced hostname validation. It does not verify whether DNS resolution results in a private IP address. As a result, an attacker can still bypass the protection and gain access to internal resources, such as an internal RAG API or cloud instance metadata endpoints. Version 0.8.3-rc1 contains a patch.

AnalysisAI

Server-side request forgery in LibreChat 0.8.2-rc2 through 0.8.2 allows authenticated users to access internal network resources via incomplete DNS validation bypass. Despite a prior SSRF patch, the current hostname validation fails to check if DNS resolution points to private IP addresses, enabling attackers to reach internal RAG APIs and cloud metadata endpoints. CVSS 7.7 with network-based attack vector and low complexity. EPSS data not available; no confirmed active exploitation (not listed in CISA KEV). Patch released in version 0.8.3-rc1.

Technical ContextAI

This vulnerability affects LibreChat (cpe:2.3:a:danny-avila:librechat), an open-source ChatGPT alternative with extended capabilities including agent actions and Model Context Protocol (MCP) support. The flaw represents CWE-918 (Server-Side Request Forgery) where inadequate input validation in agent action or MCP handlers permits DNS rebinding attacks. The previous SSRF mitigation implemented hostname-based filtering but failed to validate the resolved IP addresses post-DNS lookup. This allows attackers to leverage DNS entries that resolve to RFC 1918 private address spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (169.254.0.0/16), circumventing hostname blocklists. The vulnerability specifically targets environments where LibreChat integrates with internal services like Retrieval-Augmented Generation APIs or operates in cloud environments with accessible metadata services (AWS 169.254.169.254, Azure 169.254.169.254, GCP metadata.google.internal).

RemediationAI

Upgrade immediately to LibreChat version 0.8.3-rc1 or later, which implements comprehensive IP address validation post-DNS resolution to prevent private IP access. The patch extends the prior hostname-based filtering with explicit checks for private IP ranges (RFC 1918), loopback addresses, link-local addresses, and cloud metadata endpoints. Organizations unable to upgrade immediately should implement network-level egress filtering to block LibreChat server access to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8) and cloud metadata services. Additionally, restrict authenticated user permissions where feasible and monitor agent action usage for suspicious internal hostname references. Review application logs for requests to private IP addresses or metadata endpoints as potential indicators of exploitation attempts. Full remediation details and patch download available in the GitHub security advisory at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-f92m-jpv7-55p2.