CVE-2026-32625 Valters IT Hub / 2h The flaw resides in the Model Context Protocol (MCP) server integration, where the application resolves environment variable placeholders against the server's during Zod schema validation of user-supplied MCP server URLs. An authenticated attacker can craft a malicious MCP server configuration with a URL containing environment variable references (e.g., ). When the server validates this URL, it substitutes the placeholder with the actual environment variable va

CVE-2026-32625 is a critical information disclosure vulnerability in LibreChat, an open-source ChatGPT clone supporting multiple AI providers. The flaw resides in the Model Context Protocol (MCP) server integration, where the application resolves ${VAR} environment variable placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. An authenticated attacker can craft a malicious MCP server configuration with a URL containing environment variable references (e.g., ). When the server validates this URL, it substitutes the placeholder with the actual environment variable value, transmitting sensitive secrets like CREDS_KEY , CREDS_IV , JWT_SECRET , and MONGO_URI to the attacker-controlled domain in the request URL. This allows full compromise of cryptographic materials and database credentials without administrative privileges. The vulnerability is patched in version 0.8.4-rc1.

LibreChat is distributed as an npm package ( librechat ). The vulnerability affects versions up to and including 0.8.3. Users should update to version 0.8.4-rc1 or later. The package does not have a known malicious dependency chain, but the vulnerability itself allows exfiltration of environment variables, which could include API keys for AI providers (e.g., OpenAI, Anthropic) and database credentials.

Threat Level: Critical. The vulnerability allows an authenticated attacker to exfiltrate all environment variables, including cryptographic keys and database credentials, leading to full system compromise.

The vulnerability exists in the MCP server URL validation logic. LibreChat uses Zod schemas to validate user-supplied MCP server configurations. During validation, the code resolves ${VAR} placeholders by looking up the variable name in process.env . This is intended to allow users to reference environment variables in URLs, but it does not sanitize or restrict which variables can be accessed.

Affected Component: librechat package, specifically the MCP server configuration validation module.

Root Cause: Unsafe use of environment variable substitution in URL validation without restricting which variables can be referenced.

Vulnerable Code ( = 0.8.4-rc1):

The patch introduces a whitelist of allowed environment variables that can be referenced in MCP URLs, preventing access to sensitive variables like JWT_SECRET and MONGO_URI .

Example Python script to automate:

Hunting Query (Splunk):

Long-term Mitigations:

What is this? Security researchers use these exact queries on Shodan.io (a engine for internet-connected devices) to find vulnerable systems globally. You can copy these dorks to see if your organization's IP space is exposed.