Insecure API Endpoint Configuration in LibreChat by Danny Avila

CVE-2026-54033

What is CVE-2026-54033?

LibreChat is an advanced ChatGPT clone that enables integration with various AI providers. A vulnerability existed before version 0.8.4-rc1, allowing users to specify custom OpenAI-compatible API endpoints by setting a baseURL. This baseURL was used to create HTTP requests without implementing necessary server-side request forgery (SSRF) validations, such as checks for private IP addresses, scheme restrictions, or DNS pinning. An attacker with authenticated access could exploit this flaw to direct requests to internal network addresses, potentially leading to unauthorized information disclosure or other attacks. This vulnerability has been addressed in version 0.8.4-rc1, which implements the necessary safeguards.

References