librechat - Config Exposure Detection

Detected the /api/config endpoint of the LibreChat web application was publicly accessible, potentially exposing internal configuration details. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the /api/config endpoint of the LibreChat web application was publicly accessible, potentially...

LibreChat Login Panel - Detection

Detected LibreChat login panel. LibreChat is an open-source, self-hosted AI chat interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detected LibreChat login panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: nextcloud-server, wazuh-dashboard, langfuse-fips, langfuse, opensearch-dashboards-fips, gitlab-rails-ce, wazuh-dashboard-fips, kibana, gitlab-rails-ce-fips, opensearch-dashboards, librechat...

CVE-2026-65900 vulnerabilities

Vulnerabilities for packages: nextcloud-server, wazuh-dashboard, langfuse-fips, langfuse, gitlab-rails-ce, wazuh-dashboard-fips, kibana, gitlab-rails-ce-fips, librechat...

CVE-2026-65901 vulnerabilities

Vulnerabilities for packages: nextcloud-server, wazuh-dashboard, langfuse-fips, langfuse, gitlab-rails-ce, wazuh-dashboard-fips, kibana, gitlab-rails-ce-fips, librechat...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: nextcloud-server, wazuh-dashboard, langfuse-fips, langfuse, opensearch-dashboards-fips, gitlab-rails-ce, wazuh-dashboard-fips, kibana, gitlab-rails-ce-fips, opensearch-dashboards, librechat...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: nextcloud-server, wazuh-dashboard, langfuse-fips, langfuse, gitlab-rails-ce, wazuh-dashboard-fips, kibana, gitlab-rails-ce-fips, opensearch-dashboards, librechat...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: nextcloud-server, wazuh-dashboard, langfuse-fips, langfuse, gitlab-rails-ce, wazuh-dashboard-fips, kibana, gitlab-rails-ce-fips, librechat...

GHSA-94RC-8X27-4472 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2026-54270 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2026-56761 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, langfuse-fips, langfuse, commercial-gitlab-rails-ee-fips, kibana, commercial-gitlab-rails-ee...

CVE-2026-54037

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and forkUserLimiter rate limiters to POST /api/convos/fork to prevent rapid-fire conversation duplication. However, the POST /api/convos/duplicate endpoint...

CVE-2026-54024

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 commit bb58a2d0 added limits: fileSize to createMulterInstance in the file upload routes. However, the POST /api/convos/import endpoint uses a separate multer instance that w...

CVE-2026-54025

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact preview pipeline. The marked library v15.0.12 does not HTML-escape double-quote characters in image alt text when a custom renderer falls throu...

CVE-2026-54027

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's toolresources e.g., context, executecode without verifying ownership or EDIT permission on the target...

CVE-2026-54030

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata RFC 9728 matches the configured MCP server URL, allowing a malicious MCP server to...

CVE-2026-54029

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user's messages. The validateMessageReq middleware only validates that the conversationId...

CVE-2026-54033

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme...

CVE-2026-54036

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authenticated user or attacker with a stolen session even when 2FA is already fully enabled on the account. This endpoint overwrites the existi...

CVE-2026-54024

CVE-2026-54024 affects LibreChat. The POST /api/convos/import endpoint uses a separate multer instance that was not updated with the same file-size limits applied to other file uploads, enabling an authenticated user to upload arbitrarily large files. This is exacerbated by the application-level ...