CVE-2026-31951: LibreChat Information Disclosure Flaw

CVE-2026-31951 Overview

CVE-2026-31951 is an information disclosure vulnerability in LibreChat, an open-source ChatGPT clone with additional features. The vulnerability exists in versions 0.8.2-rc1 through 0.8.3-rc1 and allows attackers to exfiltrate OAuth tokens from victims through maliciously crafted Model Context Protocol (MCP) servers.

User-created MCP servers in LibreChat can include arbitrary HTTP headers that undergo credential placeholder substitution. An attacker can create a malicious MCP server with headers containing sensitive credential placeholders such as {{LIBRECHAT_OPENID_ACCESS_TOKEN}}, causing victims who call tools on that server to have their OAuth tokens sent to attacker-controlled infrastructure.

Critical Impact

Successful exploitation allows attackers to steal OAuth access tokens from LibreChat users, potentially enabling account takeover, unauthorized access to connected services, and compromise of user data across integrated platforms.

Affected Products

• LibreChat versions 0.8.2-rc1 through 0.8.3-rc1
• LibreChat 0.8.3-rc1 (specifically vulnerable)
• Self-hosted and cloud-deployed LibreChat instances running affected versions

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-31951 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-31951

Vulnerability Analysis

This vulnerability represents a classic information disclosure flaw (CWE-200) stemming from improper handling of credential placeholder substitution in user-controlled input. The core issue lies in LibreChat's MCP server implementation, which allows users to define custom HTTP headers for their MCP servers.

The MCP (Model Context Protocol) servers in LibreChat support dynamic credential injection through placeholder variables. When a user creates an MCP server, they can specify custom HTTP headers that are processed during API calls. The application performs credential substitution on these headers, replacing placeholders like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} with actual OAuth tokens.

The vulnerability arises because this substitution occurs on headers defined by any user, not just the token owner. When a victim interacts with a malicious MCP server (by calling tools hosted on it), the victim's OAuth credentials are substituted into the attacker-defined headers and sent to the attacker's endpoint.

Root Cause

The root cause is insufficient access control and input validation in the MCP server header processing logic. The application fails to restrict which credential placeholders can be used in user-created MCP server configurations. There is no validation to ensure that credential placeholders in headers should only resolve to the creating user's credentials, rather than the calling user's credentials.

The design flaw allows the separation between MCP server creator and MCP server consumer to be exploited, as credential substitution happens in the context of the consumer (victim) rather than being limited to the creator's own credentials.

Attack Vector

The attack requires an authenticated attacker to create a malicious MCP server within LibreChat. The attack vector is network-based and requires low privileges (a valid LibreChat account) along with user interaction (the victim must call a tool on the malicious MCP server).

The attack flow proceeds as follows: First, the attacker creates an MCP server with custom HTTP headers containing credential placeholders pointing to an attacker-controlled endpoint. When a victim user browses available MCP servers and invokes a tool on the malicious server, LibreChat processes the request and substitutes the victim's OAuth token into the attacker-defined headers. The request is then sent to the attacker's endpoint with the victim's credentials embedded in the headers, allowing the attacker to capture and abuse the OAuth token.

Detection Methods for CVE-2026-31951

Indicators of Compromise

• Unusual MCP server configurations containing credential placeholder strings in HTTP headers (e.g., {{LIBRECHAT_OPENID_ACCESS_TOKEN}})
• MCP servers with headers pointing to external or untrusted endpoints
• Unexpected outbound HTTP requests from LibreChat to unfamiliar domains
• OAuth token reuse from different IP addresses or geographic locations

Detection Strategies

• Monitor MCP server creation events for headers containing credential placeholder patterns
• Implement logging for all MCP server tool invocations to identify unusual access patterns
• Analyze network traffic for outbound requests containing OAuth tokens in custom headers
• Review MCP server configurations periodically for suspicious header definitions

Monitoring Recommendations

• Enable verbose logging for MCP server interactions and header substitution events
• Set up alerts for MCP servers created with headers pointing to non-whitelisted domains
• Monitor for anomalous OAuth token usage patterns that may indicate token theft
• Implement network egress monitoring to detect data exfiltration attempts

How to Mitigate CVE-2026-31951

Immediate Actions Required

• Upgrade LibreChat to version 0.8.3-rc2 or later immediately
• Audit existing MCP server configurations for malicious header definitions
• Rotate OAuth tokens and OpenID credentials for all users who may have interacted with untrusted MCP servers
• Review access logs to identify potential token exfiltration incidents

Patch Information

The vulnerability has been fixed in LibreChat version 0.8.3-rc2. The patch addresses the credential substitution logic to prevent user-created MCP servers from accessing other users' credential placeholders. Organizations should upgrade to this version or later as soon as possible.

For detailed patch information and the security advisory, see the GitHub Security Advisory GHSA-pmw7-gqwj-f954.

Workarounds

• Disable user-created MCP servers until the patch can be applied
• Implement network-level restrictions to block outbound requests from LibreChat to untrusted external endpoints
• Review and remove any existing MCP servers with suspicious header configurations
• Consider implementing an allowlist for MCP server endpoints until patching is complete

# Review MCP server configurations for suspicious headers
# Search for credential placeholder patterns in your LibreChat deployment
grep -r "LIBRECHAT_OPENID" /path/to/librechat/data/
grep -r "ACCESS_TOKEN" /path/to/librechat/mcp-servers/

# Verify LibreChat version
cat /path/to/librechat/package.json | grep version