What is the CVSS score of CVE-2026-31951?

CVE-2026-31951 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Librechat are affected by CVE-2026-31951?

Organizations using versions 0.8.2-rc1 should be aware of notable risk from CVE-2026-31951, a information exposure vulnerability rated CVSS 6.8.

How to fix or mitigate CVE-2026-31951?

Within 30 days: Identify affected systems running versions 0.8.2-rc1 and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

Librechat CVE-2026-31951

EUVD-2026-16769 MEDIUM

Information Exposure (CWE-200)

2026-03-27 GitHub_M

Information Disclosure Librechat

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 19:45 euvd

EUVD-2026-16769

Analysis Generated

Mar 27, 2026 - 19:45 vuln.today

CVE Published

Mar 27, 2026 - 19:29 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created MCP (Model Context Protocol) servers can include arbitrary HTTP headers that undergo credential placeholder substitution. An attacker can create a malicious MCP server with headers containing {{LIBRECHAT_OPENID_ACCESS_TOKEN}} (and others), causing victims who call tools on that server to have their OAuth tokens exfiltrated. Version 0.8.3-rc2 fixes the issue.

AnalysisAI

LibreChat versions 0.8.2-rc1 through 0.8.3-rc1 leak OAuth access tokens when authenticated users interact with malicious MCP servers, which can inject credential placeholders into HTTP headers that are automatically substituted with sensitive tokens. An attacker can create a rogue MCP server containing headers like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} to harvest victim credentials during tool execution; the vulnerability is fixed in version 0.8.3-rc2. No public exploit code or CISA KEV listing is documented, but the attack requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world impact.

Technical ContextAI

LibreChat implements MCP (Model Context Protocol) server integration that allows users to create custom server configurations. The vulnerability stems from unsafe credential placeholder substitution in HTTP headers (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). When a user invokes tools on an MCP server, LibreChat processes headers and replaces templated placeholders such as {{LIBRECHAT_OPENID_ACCESS_TOKEN}} with actual OAuth tokens obtained during user authentication. An attacker-controlled MCP server definition can include these placeholders in response headers or request interception points, allowing token exfiltration without proper access control or input validation. The attack leverages LibreChat's trust in user-created MCP server definitions and its automatic token injection mechanism.

RemediationAI

Upgrade to LibreChat version 0.8.3-rc2 or later, which implements secure header handling and disables automatic credential placeholder substitution in MCP server headers. Users unable to upgrade immediately should avoid configuring or using untrusted MCP servers and audit existing MCP server definitions for suspicious header configurations. Detailed patching guidance is available in the GitHub security advisory at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-pmw7-gqwj-f954.