Is CVE-2026-54033 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54033 being exploited in the wild.

How severe is CVE-2026-54033?

High severity, with a CVSS score of 7.7, published 25 June 2026.

Is there a fix for CVE-2026-54033?

A patch was published on 2026-08-04: Fixed in version 0.8.4-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54033 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54033?

Check whether you run LibreChat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54033: LibreChat SSRF via custom endpoint baseURL

CVE-2026-54033 · Severity: high · CVSS 7.7 · Published 2026-06-25

LibreChat is an open-source interface that allows users to connect to various AI models like ChatGPT. A security flaw allows authenticated users to redirect the application's internal requests to unintended locations by providing a malicious "Base URL" in the settings. This could allow an attacker to access sensitive internal company data, steal cloud credentials, or probe private network services that are not normally exposed to the internet.

Technologies: LibreChat. Vendors: LibreChat.

Quick answers

Is CVE-2026-54033 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54033 being exploited in the wild.
How severe is CVE-2026-54033?: High severity, with a CVSS score of 7.7, published 25 June 2026.
Which products and versions are affected?: LibreChat < 0.8.4-rc1.
Is there a fix for CVE-2026-54033?: A patch was published on 2026-08-04: Fixed in version 0.8.4-rc1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54033 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54033?: Check whether you run LibreChat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in LibreChat due to insufficient validation of user-supplied 'baseURL' configurations for custom endpoints. While the application implements SSRF protections for certain tools, these checks (such as private IP filtering and DNS pinning) are bypassed when constructing requests in components like OllamaClient.js and Runs/methods.js. An authenticated attacker can provide internal network addresses (e.g., loopback or cloud metadata services like 169.254.169.254) as a baseURL. This allows the attacker to perform internal service discovery, access sensitive metadata, or forward configured API keys to unauthorized internal listeners. The vulnerability is addressed in version 0.8.4-rc1.

Affected products

danny-avila LibreChat < 0.8.4-rc1

Timeline

2026-06-02: advisory: GitHub Security Advisory published
2026-06-25: disclosed: NVD publication date
2026-08-04: patched: Fixed in version 0.8.4-rc1

References

https://github.com/danny-avila/LibreChat/security/advisories/GHSA-gc9r-88c3-7qhq

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.