LibreChat ist ein ChatGPT-Klon mit zusätzlichen Funktionen. Version 0.8.1-rc2 ist anfällig für eine Server-Side Request Forgery (SSRF) vulnerability aufgrund fehlender Beschränkungen der Actions-Funktion in der Standardkonfiguration. LibreChat ermöglicht es Benutzern, Agenten mit vordefinierten Anweisungen und Aktionen zu konfigurieren, die über OpenAPI-Spezifikationen mit Remote-Diensten interagieren können, wobei verschiedene HTTP-Methoden, Parameter und Authentifizierungsmethoden, einschließlich benutzerdefinierter Header, unterstützt werden. Standardmäßig gibt es keine Beschränk

The SSRF vulnerability in LibreChat allows attackers to craft malicious agent instructions that trigger requests to internal services. Because LibreChat's Actions feature lacks proper validation, an attacker can manipulate agent configurations to send requests to the RAG API or other internal components, potentially exposing sensitive data or gaining unauthorized access. This could lead to data exfiltration, privilege escalation, or even remote code execution if the internal services are vulnerable. The lack of restrictions in the default configuration significantly broadens the attack surface, making exploitation relatively straightforward.

Organizations deploying LibreChat within Docker containers, particularly those with exposed internal APIs or sensitive data accessible via the RAG API, are at significant risk. Shared hosting environments where LibreChat instances share resources with other applications are also vulnerable, as a successful exploitation could potentially impact other tenants.

• docker: Inspect Docker container network configuration for excessive outbound access.

docker inspect <container_id> | grep NetworkSettings

• linux / server: Monitor system logs for unusual outbound HTTP requests originating from the LibreChat container.

journalctl -u librechat -f | grep -i "http://"

• generic web: Monitor access logs for requests to internal services from the LibreChat server's IP address. Look for unusual user-agent strings or request patterns.

grep "<librechat_ip>" /var/log/apache2/access.log

1. 2026-01-07Disclosure

   disclosure

1. Reserviert2025-12-29
2. Veröffentlicht2026-01-07
3. Geändert2026-01-15
4. EPSS aktualisiert2026-03-23

The primary mitigation is to upgrade to a patched version of LibreChat as soon as it becomes available. Until then, implement temporary workarounds to limit the impact. A Web Application Firewall (WAF) can be configured to block outbound requests to internal services or restrict access based on IP address or domain. Additionally, carefully review and restrict the allowed OpenAPI specifications and actions configured within LibreChat agents, limiting their ability to interact with external resources. Consider implementing network segmentation to isolate internal services from external access.