Critical Vulnerability CVE-2026-32625 Discovered in LibreChat

CVE-2026-32625 is a critical information disclosure vulnerability affecting LibreChat versions up to 0.8.3. The flaw allows authenticated users to exploit the Model Context Protocol (MCP) server integration by crafting malicious URLs that resolve environment variable placeholders. This can lead to the exfiltration of sensitive secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI to an attacker-controlled domain. The vulnerability has a CVSS score of 9.6, indicating a high severity level. A patch has been released in version 0.8.4-rc1, and users are advised to upgrade immediately to mitigate risks. Currently, there are no known public proof-of-concept exploits available. The vulnerability poses significant risks to installations running vulnerable versions of LibreChat.

Key Points: • CVE-2026-32625 allows authenticated users to exfiltrate sensitive environment variables. • The vulnerability affects LibreChat versions up to and including 0.8.3, with a CVSS score of 9.6. • Users are urged to upgrade to version 0.8.4-rc1 or later to mitigate the risk.