LibreChat CVE-2026-44653

The attacker must hold a valid LibreChat user account that has been explicitly granted VIEW-level access to at least one admin-managed MCP server - this is the specific access tier that incorrectly exposes secrets. The vulnerable endpoints are triggered by standard authenticated HTTP GET requests requiring no special tooling, crafted payloads, or race conditions. No non-default configuration is required; any deployment of LibreChat ≤0.8.3 with at least one shared MCP server and at least one VIEW-access user is exploitable. Exploitation is limited by the PR:L requirement: unauthenticated users and authenticated users who have not been granted MCP server VIEW access cannot reach the vulnerable code path. There is no user interaction requirement from a victim - the attacker acts entirely on their own session.

The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately represents the threat profile: network-reachable with no attack complexity, requiring only low-privilege authentication, with high confidentiality impact due to plaintext provider credential exposure. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The CVE is absent from CISA KEV and no POC is referenced, meaning no active or public exploitation is confirmed. Real-world risk is highest in team or enterprise LibreChat deployments where MCP servers are shared across users with varying trust levels - a single curious or malicious viewer can silently exfiltrate all underlying provider credentials without triggering any elevated-privilege alert. Risk is meaningfully bounded by the PR:L requirement: only users explicitly granted VIEW access by an admin can exploit this, excluding unauthenticated attackers and users with no MCP server access.

An attacker with a standard LibreChat account that has been granted VIEW access to a shared MCP server sends an authenticated HTTP GET request to /api/mcp/servers or /api/mcp/servers/:serverName. The JSON response contains the fully decrypted configuration including plaintext apiKey.key and oauth.client_secret values, which the attacker copies and uses directly against the upstream AI provider API - bypassing LibreChat's access controls and potentially incurring costs or exfiltrating data under the organization's provider account. No public POC has been identified, but the attack requires nothing beyond a browser or curl with a valid session token.