CVE-2026-22252: LibreChat RCE Vulnerability

CVE-2026-22252 Overview

LibreChat is an open-source ChatGPT clone with additional features. A critical command injection vulnerability exists in LibreChat versions prior to v0.8.2-rc2. The vulnerability resides in LibreChat's MCP (Model Context Protocol) stdio transport, which accepts arbitrary commands without proper validation. This flaw allows any authenticated user to execute shell commands as root inside the container through a single API request, potentially leading to complete container compromise and lateral movement within containerized environments.

Critical Impact

Authenticated users can execute arbitrary shell commands as root inside the LibreChat container, enabling full container takeover, data exfiltration, and potential escape to the host system.

Affected Products

• LibreChat versions prior to v0.8.2-rc2

Discovery Timeline

• 2026-01-12 - CVE CVE-2026-22252 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-22252

Vulnerability Analysis

This vulnerability is classified under CWE-285 (Improper Authorization), indicating a failure to properly restrict access to sensitive functionality. The MCP stdio transport component in LibreChat is designed to facilitate communication between the application and external processes. However, the implementation lacks proper input validation and command sanitization, creating a direct path for authenticated attackers to inject and execute arbitrary shell commands.

The attack surface is particularly concerning because it is network-accessible and requires only low-privilege authenticated access to exploit. Once exploited, the attacker gains root-level command execution within the container context, which can facilitate container escape attempts, cryptocurrency mining, data theft, or establishment of persistent backdoors.

Root Cause

The root cause of this vulnerability is improper authorization and input validation in the MCP stdio transport handler. The application fails to sanitize or validate commands passed through the MCP interface before executing them via the system shell. This design flaw allows user-controlled input to be directly interpreted as shell commands, bypassing any intended security boundaries. The lack of a command allowlist or proper input escaping enables authenticated users to inject malicious payloads that execute with elevated privileges.

Attack Vector

The vulnerability can be exploited remotely over the network by any authenticated user. An attacker needs only valid credentials to access the LibreChat application and can then craft a malicious API request targeting the MCP stdio transport endpoint. The injected commands execute as root within the container, giving the attacker complete control over the containerized environment. No additional user interaction is required beyond the initial authentication.

The attack flow involves:

1. Authenticating to the LibreChat application with valid credentials
2. Crafting an API request containing malicious shell commands
3. Sending the request to the MCP stdio transport endpoint
4. The server executing the commands as root without validation

For technical details regarding the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-cxhj-j78r-p88f.

Detection Methods for CVE-2026-22252

Indicators of Compromise

• Unexpected shell processes spawned by the LibreChat container process
• Unusual outbound network connections from the container to external hosts
• Presence of unauthorized files or modified system configurations within the container
• Anomalous API requests to MCP-related endpoints with shell metacharacters or command syntax

Detection Strategies

• Monitor container runtime logs for unexpected command execution patterns, especially those running as root
• Implement API request logging and analyze for shell injection patterns such as ;, |, &&, $(), or backticks in MCP transport requests
• Deploy runtime container security tools to detect and alert on anomalous process creation within LibreChat containers
• Review authentication logs for compromised accounts being used to exploit the vulnerability

Monitoring Recommendations

• Enable detailed audit logging for all API endpoints, particularly those related to MCP functionality
• Configure alerts for root-level process execution within containers that deviate from normal application behavior
• Implement egress traffic monitoring to detect potential data exfiltration or command-and-control communications
• Regularly review container image integrity and file system changes to detect post-exploitation persistence mechanisms

How to Mitigate CVE-2026-22252

Immediate Actions Required

• Upgrade LibreChat to version v0.8.2-rc2 or later immediately
• Review authentication logs for suspicious activity or unauthorized access attempts
• Audit container environments running LibreChat for signs of compromise
• Consider temporarily restricting access to the LibreChat instance until patching is complete

Patch Information

The vulnerability has been addressed in LibreChat version v0.8.2-rc2. The fix implements proper command validation and sanitization in the MCP stdio transport handler. Organizations should update to this version or later as soon as possible. The patch commit is available at the GitHub Commit Update for review.

Workarounds

• Restrict network access to LibreChat instances using firewall rules or network segmentation
• Implement additional authentication layers such as VPN or zero-trust network access before allowing connections to LibreChat
• Run the LibreChat container with reduced privileges using container security contexts (non-root user, dropped capabilities)
• Deploy a Web Application Firewall (WAF) to filter malicious requests targeting MCP endpoints

# Example: Run LibreChat container with reduced privileges
docker run -d \
  --user 1000:1000 \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  --read-only \
  librechat:v0.8.2-rc2