CVE-2025-69222: SSRF in LibreChat Docker Container

The SSRF vulnerability in LibreChat allows an attacker to craft malicious agent instructions that trigger requests to arbitrary internal or external resources. Because the Actions feature lacks input validation, an attacker can bypass intended security boundaries and directly access the RAG API, potentially exposing sensitive data used for generating responses. This could include internal database credentials, API keys, or proprietary data. Furthermore, the attacker could leverage the SSRF to scan internal networks, identify other vulnerable services, and potentially pivot to other systems within the infrastructure, significantly expanding the attack surface. The lack of restrictions makes this a high-impact vulnerability, similar to scenarios where SSRF is used to access cloud metadata services.

1. Reserved2025-12-29
2. Published2026-01-07
3. Modified2026-01-15
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-69222 is to upgrade to a patched version of LibreChat as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. Restrict network access to the LibreChat container using Docker network policies or firewall rules to limit its ability to reach internal resources. Carefully review and restrict the permissions granted to LibreChat agents, minimizing their access to sensitive APIs and data. Implement a Web Application Firewall (WAF) with SSRF protection rules to filter outbound requests and block malicious patterns. Monitor LibreChat logs for unusual outbound requests that could indicate exploitation attempts.