Server-Side Request Forgery (SSRF) in LibreChat - CVE-2026-54033
Published: June 3, 2026
Vulnerability identifier: #VU133254
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-54033
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information from internal network resources.
The vulnerability exists due to server-side request forgery (SSRF) in user-configured API endpoint baseURL handling when constructing HTTP requests from a user-supplied baseURL. A remote user can set a crafted baseURL pointing to an internal address to disclose sensitive information from internal network resources.
The configured API key may be forwarded in the Authorization header to the target endpoint.
Affected software
LibreChat
How to mitigate CVE-2026-54033
Install security update from vendor's website.
LibreChat - update to 0.8.4 rc1