Executive brief
LibreChat, an open-source AI interface for multiple providers, contains a critical flaw in how it handles server configurations. An authenticated user can trick the system into sending its internal security secrets—including database credentials and encryption keys—to an external server controlled by the attacker. This allows an attacker to gain full control over the application's data, forge user sessions, and access private API keys for AI services.
Technical details
A vulnerability in LibreChat versions up to 0.8.3 exists within the Model Context Protocol (MCP) server integration. The application uses a Zod schema transformation that calls `extractEnvVariable` on user-supplied MCP server URLs, which resolves `${VAR}` placeholders against the server's `process.env`. An authenticated attacker can submit a malicious URL via the `POST /api/mcp/servers` endpoint containing environment variable references (e.g., `${JWT_SECRET}`). During schema validation and subsequent connection testing via `MCPServerInspector.inspect()`, the server resolves these variables and transmits them as part of an HTTP request to an attacker-controlled domain. This results in the exposure of critical secrets such as `CREDS_KEY`, `JWT_SECRET`, and `MONGO_URI`. The issue is patched in version 0.8.4-rc1.
Affected products
- danny-avila LibreChat <= 0.8.3
Timeline
- 2026-06-02: disclosed
- 2026-06-02: advisory
- 2026-06-02: patched: Patched in v0.8.4-rc1