CVE-2026-32625: LibreChat Exfiltrates Server Secrets via MCP Server URL Injection

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-02 · updated 2026-07-22
Weakness: CWE-200

Description

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any authenticated user can create a malicious MCP server configuration with a URL pointing to an attacker-controlled domain containing environment variable references, causing the LibreChat server to connect to the attacker's server and transmit critical secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL. This enables full compromise of the installation's cryptographic materials and database credentials without requiring administrative privileges. This is patched in version 0.8.4-rc1.

Affected products

danny-avila LibreChat: before 0.8.4 — fixed in 0.8.4

How to fix

Upgrade to a fixed version: danny-avila LibreChat 0.8.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-32625 or the next vulnerability affects your stack