www.valtersit.com

Critical Vulnerability CVE-2026-32625 Discovered in LibreChat

First seen 3 Jun 2026, 11:55 UTC • •78.0

Article Content

1 / 5

Browse articles

ThreatCluster •June 4, 2026 at 11:53 UTC

•CVE-2026-32625 allows authenticated users to exfiltrate sensitive environment variables.
•The vulnerability affects LibreChat versions up to and including 0.8.3, with a CVSS score of 9.6.
•Users are urged to upgrade to version 0.8.4-rc1 or later to mitigate the risk.

CVE-2026-32625 is a critical information disclosure vulnerability affecting LibreChat versions up to 0.8.3. The flaw allows authenticated users to exploit the Model Context Protocol (MCP) server integration by crafting malicious URLs that resolve environment variable placeholders. This can lead to the exfiltration of sensitive secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI to an attacker-controlled domain. The vulnerability has a CVSS score of 9.6, indicating a high severity level. A patch has been released in version 0.8.4-rc1, and users are advised to upgrade immediately to mitigate risks. Currently, there are no known public proof-of-concept exploits available. The vulnerability poses significant risks to installations running vulnerable versions of LibreChat.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 156d ago How this analysis works

Timeline

2026-06-02

CVE-2026-32625 published

The CVE was officially published, detailing a critical vulnerability in LibreChat affecting versions up to 0.8.3.

Feedly

2026-06-03

Vulnerability details disclosed

Valters IT Hub reported on the critical information disclosure vulnerability in LibreChat, emphasizing the risks of environment variable exfiltration.

Valters IT Hub

2026-06-03

Patch released for LibreChat

LibreChat released version 0.8.4-rc1 to address the critical vulnerability, urging users to upgrade immediately.

Feedly