How severe is CVE-2026-44653?

CVE-2026-44653 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-44653 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-44653?

CVE-2026-44653 affects Librechat. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-44653?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-44653 have an EU (EUVD) identifier?

Yes. CVE-2026-44653 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34047.

When was CVE-2026-44653 published?

CVE-2026-44653 was published on 2026-06-02 and last updated on 2026-06-17.

CVE-2026-44653

CVE-2026-44653 is a medium-severity vulnerability in Librechat with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-201.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-34047
Weakness: CWE-201
Affected product: Librechat
Published: 2026-06-02
Last modified: 2026-06-17

Description

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users with only `VIEW` access to an MCP server can retrieve the server's decrypted admin-managed secrets through `GET /api/mcp/servers` and `GET /api/mcp/servers/:serverName`. The returned config includes plaintext values for `apiKey.key` and `oauth.client_secret`. This allows viewers of a shared MCP server to exfiltrate the underlying provider credentials. Version 0.8..4 contains a patch. Other remediations include: never returning decrypted admin-managed secrets to non-owners; redacting apiKey.key and oauth.client_secret from all API responses consider returning only boolean presence indicators for secrets, similar to the auth-values route pattern; and, if owners need to edit configs without re-entering secrets, preserving secrets server-side and returning placeholders instead of plaintext.

Frequently asked questions

What is CVE-2026-44653?: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users with only `VIEW` access to an MCP server can retrieve the server's decrypted admin-managed secrets through `GET /api/mcp/servers` and `GET /api/mcp/servers/:serverName`. The returned config includes plaintext values for `apiKey.key` and `oauth.client_secret`. This allows viewers of a shared MCP server to exfiltrate the underlying provider credentials. Version 0.8..4 contains a patch. Other remediations include: never returning decrypted admin-managed secrets to non-owners; redacting apiKey.key and oauth.client_secret from all API responses consider returning only boolean presence indicators for secrets, similar to the auth-values route pattern; and, if owners need to edit configs without re-entering secrets, preserving secrets server-side and returning placeholders instead of plaintext.
How severe is CVE-2026-44653?: CVE-2026-44653 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-44653 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-44653?: CVE-2026-44653 affects Librechat. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-44653?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-44653 have an EU (EUVD) identifier?: Yes. CVE-2026-44653 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-34047.
When was CVE-2026-44653 published?: CVE-2026-44653 was published on 2026-06-02 and last updated on 2026-06-17.

References

https://github.com/danny-avila/LibreChat/security/advisories/GHSA-6vqg-rgpm-qvf9

Affected products (1)

cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*

More vulnerabilities in Librechat

CVE-2024-41704 — Critical (CVSS 9.8): LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.
CVE-2024-41703 — Critical (CVSS 9.8): LibreChat through 0.7.4-rc1 has incorrect access control for message updates.
CVE-2026-32625 — Critical (CVSS 9.6): LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the…
CVE-2026-22252 — Critical (CVSS 9.1): LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts…
CVE-2025-69222 — Critical (CVSS 9.1): LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery…
CVE-2024-10361 — Critical (CVSS 9.1): An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the…

All CVEs affecting Librechat →

Other CWE-201 vulnerabilities

CVE-2025-49408 — Critical (CVSS 10.0): Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded…
CVE-2024-7205 — Critical (CVSS 9.4): When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to…
CVE-2026-39912 — Critical (CVSS 9.1): V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the…
CVE-2025-48749 — Critical (CVSS 9.1): Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and before & after v.11.1.25134.03 inserts Sensitive…
CVE-2025-11500 — High (CVSS 8.7): Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication…
CVE-2025-48045 — High (CVSS 8.7): An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user…

Browse all CWE-201 vulnerabilities →