LibreChat EUVD-2026-39460

Exploitation requires an authenticated LibreChat account (PR:L) and that the instance permits users to configure custom OpenAI-compatible endpoints by supplying a baseURL - the exact feature named in the advisory. The attacker sets baseURL to an internal/private address and triggers an outbound call; no user interaction by a victim and no special client are needed (AC:L, UI:N). What limits exploitation in practice: an account is mandatory, so instances with closed registration shrink the attacker pool to trusted users; the impact is bounded by what internal services the LibreChat server can actually reach on its network; and value is highest in cloud or segmented-network deployments where the server can hit metadata endpoints or internal-only hosts. Instances already on 0.8.4-rc1 or later are not exploitable.

The signals are moderately strong but not emergency-level. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7 High) indicates a network-reachable, low-complexity attack requiring only low privileges (an authenticated account) and no user interaction, with a scope change reflecting that the server pivots to other systems and a high confidentiality impact with no integrity or availability effect. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; no SSVC decision was supplied either. The vulnerability is not listed in CISA KEV and no public POC or exploit code is referenced, so this is no public exploit identified at time of analysis - a genuine but not actively-exploited priority. The main mitigating factor is the authentication requirement (PR:L): on a closed, invite-only instance the attacker pool is limited to trusted users, whereas any LibreChat deployment with open or self-service registration effectively exposes this to anyone, materially raising real-world risk. No conflicting data was detected between the vector and description - both consistently describe authenticated, remote, integrity-neutral information disclosure.

An attacker registers or uses an existing low-privilege account on a LibreChat instance, adds a custom OpenAI-compatible provider, and sets its baseURL to an internal target such as http://169.254.169.254/latest/meta-data/ or an internal admin service. When they trigger a chat completion against that provider, the LibreChat server makes the request from inside the trusted network and returns the response content to the attacker, disclosing cloud credentials or internal data. No POC is referenced, but the low attack complexity means exploitation requires nothing more than the built-in endpoint configuration UI.