What is the CVSS score of CVE-2026-32625?

CVE-2026-32625 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of LibreChat are affected by CVE-2026-32625?

LibreChat contains a critical vulnerability enabling attackers to extract database credentials, encryption keys, and authentication tokens through maliciously crafted MCP URLs, compromising the…

How to fix or mitigate CVE-2026-32625?

Within 24 hours: Inventory all LibreChat deployments, restrict outbound network connectivity from LibreChat backend services, and enable audit logging for URL processing. Within 7 days: Upgrade all instances to LibreChat 0.8.4-rc1 or later, then immediately rotate CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI values in all environments. Within 30 days: Complete post-upgrade verification across all deployments, audit credential rotation logs, and implement network segmentation to limit MCP endpoint communications.

LibreChat CVE-2026-32625

CRITICAL

Information Exposure (CWE-200)

2026-06-02 security-advisories@github.com

Information Disclosure Librechat

9.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 23:30 vuln.today

DescriptionGitHub Advisory

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.

AnalysisAI

{VAR} placeholders against the host process environment, so attacker-controlled MCP URLs cause the LibreChat backend to transmit CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI to an attacker-controlled host. No public exploit identified at time of analysis, and the issue is fixed in 0.8.4-rc1.

Technical ContextAI

LibreChat is a multi-provider ChatGPT-style web application that integrates with MCP (Model Context Protocol) servers configured per user. During validation of user-submitted MCP server URLs, the application performs ${VAR} interpolation against the Node.js process.env on the LibreChat server. Because the interpolation runs server-side before the outbound MCP connection is initiated, any environment variable held by the host process - including cryptographic keys (CREDS_KEY, CREDS_IV), the JWT signing secret, and the MongoDB connection string - can be embedded directly into the request URL sent to the remote host. The underlying weakness is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), driven by an unsafe templating step inside the configuration parser that fails to distinguish between trusted operator-supplied values and untrusted user input.

RemediationAI

Upgrade to LibreChat 0.8.4-rc1 or later, which is the vendor-confirmed patched release per GHSA-4pcc-j6m6-wcwx (https://github.com/danny-avila/LibreChat/security/advisories/GHSA-4pcc-j6m6-wcwx). Where immediate upgrade is not possible, disable the MCP server integration entirely or restrict MCP configuration to trusted administrators only by removing the ability for standard users to define MCP server URLs, accepting the trade-off that end-user MCP functionality is lost. Additionally, because secrets may already have been exfiltrated by any user on an exposed instance, rotate CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI after patching, invalidate existing JWTs (forcing user re-login), and review outbound network logs for connections to unexpected MCP hosts during the exposure window; closing self-registration on public deployments is also recommended as a compensating control until upgrade is complete.