PT-2026-28432 · Librechat · Librechat

Logicx24 · Published 2026-03-27 · Updated 2026-03-28 · CVE-2026-31951

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LibreChat versions 0.8.2-rc1 through 0.8.3-rc1

Description LibreChat, a ChatGPT clone, has an issue where user-created Model Context Protocol (MCP) servers can include arbitrary HTTP headers. These headers are subject to credential placeholder substitution. An attacker can create a malicious MCP server with headers containing {{LIBRECHAT OPENID ACCESS TOKEN}} and other placeholders. When victims call tools on this server, their OAuth tokens can be exfiltrated. The API endpoint is susceptible through the use of malicious MCP servers. The vulnerable parameter is the HTTP header content within the MCP server configuration.

Recommendations Update to version 0.8.3-rc2 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-31951

GHSA-PMW7-GQWJ-F954

Affected Products

Librechat

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31951.json · Exploit
• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-pmw7-gqwj-f954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31951 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31951 · Vendor Advisory
• https://twitter.com/CVEnew/status/2037719420601331770 · Twitter Post