LibreChat MCP Server URL Environment Variable Exfiltration

Authenticated users can weaponize ${VAR} placeholder resolution in user-supplied MCP server URLs to exfiltrate JWT_SECRET, CREDS_KEY/CREDS_IV, and MONGO_URI to an attacker-controlled domain

LibreChat versions up to and including 0.8.3 contain a critical information-disclosure flaw (CVE-2026-32625, CVSS 9.6) in its Model Context Protocol integration. Any authenticated user — no admin privileges required — can register a malicious MCP server URL containing ${JWT_SECRET}, ${CREDS_KEY}, ${CREDS_IV}, or ${MONGO_URI} placeholders. LibreChat's Zod validation resolves these against the server's own environment before connecting, transmitting the live secrets to an attacker-controlled domain. The blast radius is total: forged auth tokens, decrypted stored credentials, and direct database access. Fixed in v0.8.4-rc1, which strips env-var interpolation from user-supplied MCP URLs.