CVE-2026-32625: LibreChat Exfiltrates Server Secrets via MCP Server URL Injection

Synopsis

A server-side template injection vulnerability affects LibreChat versions up to and including 0.8.3. Any authenticated user can craft a malicious MCP server URL containing environment variable placeholders (in the form ${VAR}), which LibreChat resolves against its own process environment during schema validation, then transmits to an attacker-controlled host. Successful exploitation exposes cryptographic secrets and database credentials, enabling full compromise of the installation. A patched-image rebuild at version 0.8.4-rc1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the LibreChat service over the network to submit a crafted MCP server configuration.

• AuthenticationRequired

  Any low-privilege user account is sufficient; no administrative access is needed to supply a malicious MCP server URL.

• Victim interactionNot required

  No user interaction beyond the attacker's own session is needed; the server resolves environment variables and makes the outbound request automatically during validation.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply provides a URL with ${VAR} placeholders and receives the resolved secrets at their endpoint.

Blast Radius

• Reads high-value server secrets including CREDS_KEY, CREDS_IV, and JWT_SECRET, which are transmitted in plaintext to the attacker's endpoint via the outbound connection.
• Reads the MONGO_URI credential, giving the attacker direct connection details for the backing database.
• With possession of JWT_SECRET, the attacker forges valid session tokens for any user, including administrators, achieving full account takeover.
• With CREDS_KEY and CREDS_IV, the attacker decrypts any credentials stored in LibreChat's encrypted credential store, exposing all saved API keys and provider tokens.