By vendor

Librechat vulnerabilities

Known CVEs affecting Librechat products, prioritized by severity, with SEC.co remediation and detection guidance.

12 published vulnerabilities

• CVE-2026-44654HIGH 8.1

  LibreChat is an open-source ChatGPT alternative that integrates multiple AI providers. A critical flaw in versions up to 0.8.3 allows a user with editing privileges on a shared agent to permanently delete files — not just from that shared agent, but globally across the entire system. This means if a file owner has reused the same file across multiple private agents, an attacker with edit access to just one shared agent can destroy those files, leaving the owner's other agents broken with orphaned file references. The owner doesn't control the attacker's edit access to their own private agents; they simply stop working.

• CVE-2026-54030HIGH 8.0

  LibreChat, a self-hosted ChatGPT alternative that integrates with multiple AI providers, contains a flaw in how it validates OAuth credentials when connecting to Model Context Protocol (MCP) servers. Before version 0.8.5, the application fails to verify that incoming OAuth tokens are actually intended for the server you configured, leaving the door open for a malicious MCP server to intercept and steal those tokens. An attacker would need to trick a user into connecting to their malicious server, but once they do, they gain the ability to impersonate that user across integrated AI services.

• CVE-2026-54033HIGH 7.7

  LibreChat, a self-hosted ChatGPT alternative that integrates with multiple AI providers, contains a server-side request forgery (SSRF) vulnerability in its custom API endpoint configuration feature. Authenticated users can specify any URL as a custom OpenAI-compatible API endpoint, including internal network addresses that should not be accessible from the internet. The application fails to validate these URLs before making HTTP requests, allowing an attacker with valid credentials to probe or interact with internal services, databases, or APIs that would normally be isolated from external access. This issue was fixed in version 0.8.4-rc1.

• CVE-2026-31942HIGH 7.1

  LibreChat versions up to 0.7.6 contain a critical flaw in how API keys are managed. Any authenticated user can manipulate API key settings for other users by injecting parameters into requests, allowing them to replace legitimate API keys (from providers like OpenAI, Anthropic, or Azure) with their own or invalid ones. This means an attacker could intercept conversations through attacker-controlled API endpoints or disable a victim's service entirely.

• CVE-2026-44653MEDIUM 6.5

  LibreChat versions up to 0.8.3 expose sensitive credentials to users with view-only access to MCP (Model Context Protocol) servers. When a user with limited permissions queries the server configuration API, they receive plaintext API keys and OAuth secrets that should remain encrypted and admin-only. This breaks the intended access control model where viewers should never see the credentials needed to authenticate with external AI providers. An attacker with even basic read access can steal these secrets and impersonate the legitimate service.

• CVE-2026-54024MEDIUM 6.5

  LibreChat, a ChatGPT alternative supporting multiple AI providers, contains a file upload vulnerability in its conversation import endpoint. An authenticated user can upload arbitrarily large files to the server, consuming disk space and memory until the service becomes unavailable. This occurs because the import endpoint uses a separate file upload handler that wasn't updated when size limits were added elsewhere in the application, and the default configuration leaves the size check disabled. The vulnerability affects versions prior to 0.8.4-rc1.

• CVE-2026-54027MEDIUM 6.5

  LibreChat, a multi-provider AI chat application, contains an authorization bypass in its image upload endpoint. Authenticated users can upload files into any agent's resource storage without permission checks, bypassing existing controls on the standard file upload route. An attacker with basic login credentials can inject malicious files into other users' agents, potentially compromising their AI tool execution environments.

• CVE-2026-54037MEDIUM 6.5

  LibreChat, an open-source ChatGPT alternative that integrates multiple AI providers, contains a rate-limiting bypass vulnerability. A previous security fix (CVE-2025-7105) added protections to one conversation-duplication endpoint, but an identical endpoint was overlooked. Authenticated users can exploit the unprotected endpoint to trigger the same resource-exhaustive operations, circumventing the earlier mitigation and potentially causing denial of service.

• CVE-2026-54040MEDIUM 5.9

  LibreChat versions before 0.8.4-rc1 contain a flaw in their two-factor authentication (2FA) backup code regeneration process. An attacker who obtains a victim's session token can regenerate that user's 2FA backup codes without needing to verify the user's identity through any authentication method. The attacker can then use the newly generated codes to bypass 2FA entirely or disable it altogether. This is a silent attack—the victim receives no notification that their backup codes have been replaced.

• CVE-2026-54025MEDIUM 5.4

  LibreChat, a popular open-source ChatGPT alternative supporting multiple AI providers, contains a stored cross-site scripting (XSS) vulnerability in its markdown artifact preview system. When a user includes an image in a markdown artifact with specially crafted alt text, the application fails to properly escape double-quote characters. An attacker can exploit this to inject malicious JavaScript code that executes in the victim's browser when the preview renders. The flaw exists because LibreChat's custom image renderer defers to a third-party library's default handler under certain conditions, and that handler does not sanitize the alt text before inserting it into HTML attributes. The vulnerability requires user interaction (viewing a preview) and authenticated access, limiting its scope but still posing a meaningful risk to collaborative environments.

• CVE-2026-54029MEDIUM 5.3

  LibreChat, a self-hosted ChatGPT alternative that integrates multiple AI providers, contains an authorization flaw in its message deletion endpoint. An authenticated attacker can delete any other user's messages by exploiting a gap between authentication (which checks conversation ownership) and authorization (which does not check message ownership). The attacker supplies their own valid conversation ID to bypass initial validation, then targets a victim's message ID for deletion. Messages deleted this way cannot be recovered. The vulnerability affects all versions before 0.8.4-rc1 and is resolved in that release.

• CVE-2026-54036MEDIUM 5.3

  LibreChat versions prior to 0.8.4-rc1 contain a critical flaw in two-factor authentication (2FA) management. An attacker who has compromised a user's session token can call a specific API endpoint to completely reset that user's 2FA settings—overwriting their TOTP secret, invalidating backup codes, and disabling 2FA entirely—without needing to know or verify the existing 2FA credentials. This locks legitimate users out of their own account security while giving the attacker an open door to permanent access.