SB2026042782 - Multiple vulnerabilities in LibreChat

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026042782

SB2026042782 - Multiple vulnerabilities in LibreChat

Published: April 27, 2026 Updated: June 3, 2026

Security Bulletin ID SB2026042782
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-31944)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to steal OAuth tokens and gain unauthorized access to MCP-linked services.

The vulnerability exists due to improper authentication and session validation in the GET /:serverName/oauth/callback endpoint in api/server/routes/mcp.js when processing an OAuth callback redirect. A remote user can send a crafted authorization URL to a victim to steal OAuth tokens and gain unauthorized access to MCP-linked services.

User interaction is required to open the authorization URL, and the issue affects deployments where MCP OAuth is enabled for an integration.


2) Input validation error (CVE-ID: CVE-2026-31949)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the DELETE /api/convos endpoint when handling malformed requests with a missing or null req.body.arg value. A remote user can send a specially crafted request to cause a denial of service.

The issue triggers an unhandled TypeError that bypasses Express error handling and causes the Node.js process to exit.


3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-31945)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information from internal resources.

The vulnerability exists due to server-side request forgery (SSRF) in agent actions or MCP when processing user-supplied server URLs that resolve via DNS to private IP addresses. A remote user can supply a crafted domain name that resolves to a private IP address to disclose sensitive information from internal resources.

In cloud environments, exploitation may allow access to instance metadata endpoints.


4) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-31942)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to overwrite other users' API keys.

The vulnerability exists due to improper access control in the API keys management endpoint when handling PUT requests to /api/keys. A remote user can inject a userId parameter in the request body to overwrite other users' API keys.

The issue is caused by the request body overriding the authenticated user's ID during key update processing.


Remediation

Install update from vendor's website.

References