What is the CVSS score of CVE-2026-54033?

CVE-2026-54033 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of LibreChat are affected by CVE-2026-54033?

LibreChat versions before 0.8.4-rc1 contain an access control flaw (CVSS 7.7) that allows any user with valid account credentials to configure the system to extract data from internal company…. A patch is available.

How to fix or mitigate CVE-2026-54033?

24 hours: Identify all LibreChat deployments and document current versions; audit account access and restrict to essential personnel only; review server logs for suspicious custom endpoint configuration. 7 days: Disable the custom OpenAI-compatible endpoint feature in LibreChat configuration if not operationally required; implement network-level controls blocking outbound requests from LibreChat to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). 30 days: Subscribe to LibreChat security advisories for patch release; plan immediate upgrade to 0.8.4 or later once production-ready release is available; document custom endpoint feature dependencies and retesting plan.

LibreChat CVE-2026-54033

EUVD-2026-39460 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-25 GitHub_M

SSRF Librechat Danny Avila

6.5

CVSS 3.1 · NVD

Severity by source

Vendor (GitHub_M) PRIMARY

HIGH

qualitative

NVD

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable with low complexity, but needs an authenticated account (PR:L); SSRF pivots beyond the app (S:C) to disclose internal data (C:H), with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 15:52 NVD

HIGH MEDIUM

CVSS changed

Jun 29, 2026 - 15:52 NVD

7.7 (HIGH) 6.5 (MEDIUM)

Patch available

Jun 25, 2026 - 18:03 EUVD

Analysis Generated

Jun 25, 2026 - 17:17 vuln.today

DescriptionNVD

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation - no private IP check, no scheme restriction, no DNS pinning. An authenticated user can set baseURL to internal network addresses. This vulnerability is fixed in 0.8.4-rc1.

AnalysisAI

Server-side request forgery in LibreChat before 0.8.4-rc1 lets any authenticated user point a custom OpenAI-compatible endpoint baseURL at internal network addresses, because the URL is used to build HTTP requests with no SSRF validation whatsoever - no private-IP blocking, no scheme restriction, and no DNS pinning. By abusing the legitimate custom-endpoint feature, a logged-in user can coerce the server into reaching internal-only services and returning their responses, with a CVSS 3.1 score of 7.7 driven by a changed scope and high confidentiality impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the trivial low-complexity nature makes it readily exploitable once an account exists.

Technical ContextAI

LibreChat is a self-hosted, multi-provider ChatGPT-style web application that allows operators and users to register custom 'OpenAI-compatible' model providers. Each such provider is defined partly by a user-controllable baseURL that LibreChat uses as the destination for its outbound API calls. The flaw is a textbook CWE-918 Server-Side Request Forgery: the user-supplied baseURL flows directly into the HTTP client without an allowlist, private/loopback/link-local IP rejection, URL-scheme constraint, or DNS-rebinding protection, so the application's network position - not the user's - determines what can be reached. The affected component is the danny-avila/librechat application (cpe:2.3:a:danny-avila:librechat:*), and because the server typically sits inside a trusted network or cloud environment, requests it makes can hit cloud metadata endpoints (e.g. 169.254.169.254), internal admin panels, and other services unreachable from outside.

RemediationAI

Vendor-released patch: upgrade LibreChat to 0.8.4-rc1 or later, which adds the missing SSRF controls - this is the primary and recommended fix, per the advisory at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq. If immediate upgrading is not possible, reduce exposure by disabling or removing the user-configurable custom OpenAI-compatible endpoint feature so users cannot set arbitrary baseURL values (trade-off: legitimate custom providers stop working), and by restricting account creation - turn off open/self-service registration so only trusted users hold accounts (trade-off: higher onboarding friction). As a network compensating control, place the LibreChat server behind an egress filter or forward proxy that blocks outbound requests to RFC1918 ranges, loopback, link-local 169.254.0.0/16 (especially the cloud metadata endpoint 169.254.169.254), and non-HTTP(S) schemes (trade-off: may break legitimate internal or self-hosted model endpoints the deployment intentionally uses). On cloud hosts, additionally enforce IMDSv2 to blunt metadata theft.