Executive brief
LibreChat is an open-source interface for interacting with various AI models and providers. A security flaw allows users who have been granted basic "view" access to a shared Model Context Protocol (MCP) server to see sensitive administrative credentials in plain text. This could allow an unauthorized user to steal API keys and OAuth secrets, potentially leading to unauthorized use of paid AI services or access to linked third-party accounts.
Technical details
An information disclosure vulnerability exists in LibreChat's MCP server integration due to improper redaction of sensitive configuration data. In versions up to 0.8.3, the `GET /api/mcp/servers` and `GET /api/mcp/servers/:serverName` endpoints return decrypted configuration objects that include plaintext values for `apiKey.key` and `oauth.client_secret`. The root cause is located in the `ServerConfigsDB.mapDBServerToParsedConfig()` function, which decrypts these secrets before they are passed to the route handlers. Any authenticated user with 'VIEW' permissions on a shared MCP server can exfiltrate these credentials. The vulnerability is addressed in version 0.8.4 by implementing response sanitization.
Affected products
- danny-avila LibreChat <= 0.8.3
Timeline
- 2026-03-13: other: Vulnerability confirmed in testing environment
- 2026-06-02: disclosed: Security advisory published by vendor
- 2026-06-02: advisory: CVE-2026-44653 published