LibreChat CVE-2026-54030

Exploitation requires that LibreChat (prior to 0.8.5) be configured to use its MCP OAuth integration and that an operator/user connect the instance to an attacker-controlled MCP server - that act of trusting and adding the malicious server is the core prerequisite (reflected as UI:R in the CVSS vector). The attacker must control an MCP server that returns crafted RFC 9728 Protected Resource metadata advertising a 'resource' value for the targeted legitimate server. Limiting factors: it is not exploitable against default installs that do not use MCP OAuth or only connect to trusted servers; it is not automatable at scale (SSVC Automatable=no) because each compromise depends on a victim adding the rogue server; and there must be a legitimate OAuth-protected MCP server whose tokens are worth stealing.

Signals are mixed and should be read together. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, score 9.3) reflects a network-reachable, low-complexity flaw with a scope change (token crosses an authorization boundary to a different server) but requiring user interaction - specifically an operator electing to connect to the malicious MCP server. SSVC marks Exploitation=poc, Automatable=no, Technical Impact=total, which is consistent: severe consequence per event, but not mass-exploitable because each compromise needs a victim to add an attacker-controlled server. Counterbalancing the 9.3, EPSS is only 0.11% (1st percentile) and the CVE is not on CISA KEV - no public exploit identified and no evidence of active exploitation. Net: this is a genuinely high-impact origin-validation bug, but real-world risk is gated by the social/configuration step of trusting a malicious server, making it a priority for environments that enable MCP integrations rather than a broad emergency. The UI:R requirement and 'no public exploit' status mean the headline 9.3 overstates likelihood relative to impact.

An attacker stands up a malicious MCP server and lures a LibreChat administrator into adding it (e.g., advertised as a useful tool integration). When the operator initiates the OAuth flow, the rogue server returns Protected Resource metadata whose 'resource' value points at a legitimate server; LibreChat, not validating the resource against the configured URL, hands over or exposes the access token, which the attacker then replays against the trusted server. A proof-of-concept is referenced in the SSVC data, though no weaponized public exploit was identified.