Librechat CVE-2026-31945

LibreChat versions 0.8.2-rc2 through 0.8.2 with agent actions or MCP enabled. Requires authenticated user access (PR:L). Attacker can bypass hostname validation to access private IP addresses and internal resources like RAG APIs or cloud metadata endpoints.

The CVSS 7.7 score reflects high confidentiality impact with scope change, indicating potential for lateral movement beyond the vulnerable component. Attack complexity is low (AC:L) and requires only low-privileged authentication (PR:L), meaning any authenticated LibreChat user can exploit this vulnerability without specialized skills or tools. The network attack vector (AV:N) enables remote exploitation. However, real-world risk depends heavily on deployment context: installations with access to sensitive internal services or cloud metadata endpoints face severe risk of credential theft and privilege escalation, while isolated deployments have reduced exposure. No EPSS data is available for quantitative exploitation probability assessment, and no public exploit code or CISA KEV listing exists at time of analysis, suggesting exploitation is not yet widespread. The SSVC decision factors favor moderate-to-high priority: automatable (low technical complexity), exploitable (authenticated remote access), with high technical impact in multi-tenant or cloud deployments. The existence of a prior SSRF vulnerability and incomplete remediation indicates potential for security research community attention.

An authenticated attacker with low-privileged LibreChat access creates a malicious agent action or MCP configuration specifying a domain they control (attacker-domain.com) with DNS records pointing to internal infrastructure IP addresses such as 192.168.1.10 (internal RAG API) or 169.254.169.254 (AWS metadata service). When LibreChat processes this agent action, the hostname validation passes but DNS resolution directs the server-side request to the private IP address. The attacker retrieves sensitive information including internal API responses, cloud instance credentials (IAM roles, access keys), or internal service configurations, enabling lateral movement and privilege escalation within the victim's infrastructure. No public exploit code exists, but the low attack complexity and detailed advisory enable straightforward weaponization by threat actors with authenticated access.