CVE-2026-32625

Integration with Model Context Protocol (MCP) server resolves placeholders in the format ${VAR} to values of server process environment variables (process.env) during Zod schema validation for user-supplied MCP server URLs. The attacker creates a malicious MCP configuration pointing to a domain under their control, placing environment variable references in the URL. The LibreChat server connects to the attacker's server, transmitting secret variable values such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the URL.

The attacker gains access to critical cryptographic secrets and database credentials, enabling complete takeover of the installation — data decryption, JWT token forgery, and direct access to MongoDB database.

Update LibreChat to version 0.8.4-rc1 or later, in which the vulnerability has been patched. After updating, perform rotation of all potentially exposed secrets: CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI credentials.

LibreChat versions up to and including 0.8.3