CVE-2026-54033

MEDIUM 6.5CVE-2026-54033 · Published 25/06/2026 · updated 25/10/2026

In short

CVE-2026-54033 is a MEDIUM (CVSS 6.5) vulnerability affecting librechat (librechat).
Chance of exploitation in the next 30 days (EPSS): 0.35%, higher than 28.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
librechat librechat	`≤ 0.8.3`	No fix yet

Description

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme restriction, no DNS pinning. An authenticated user can set baseURL to internal network addresses. This vulnerability is fixed in 0.8.4-rc1.

References

danny-avila/LibreChat security advisory · Exploit

More vulnerabilities in librechat

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

librechat

≤ 0.8.3

No fix yet

Description

More vulnerabilities in librechat

See all →