LibreChat एक ChatGPT क्लोन है जिसमें अतिरिक्त विशेषताएं हैं। संस्करण 0.8.1-rc2 सर्वर-साइड रिक्वेस्ट फोर्जरी (SSRF) भेद्यता के प्रति प्रवण है, क्योंकि डिफ़ॉल्ट कॉन्फ़िगरेशन में Actions सुविधा की प्रतिबंधों की कमी है। LibreChat उपयोगकर्ताओं को पूर्वनिर्धारित निर्देशों और Actions को कॉन्फ़िगर करने की अनुमति देता है जो OpenAPI विनिर्देशों के माध्यम से दूरस्थ सेवाओं के साथ इंटरैक्ट कर सकते हैं, विभिन्न HTTP विधियों, मापदंडों और प्रमाणीकरण विधियों का समर्थन करते हैं, जिसमें कस्टम हेडर भी शामिल हैं। डिफ़ॉल्ट रूप से, सुलभ सेवाओं पर कोई प्रतिबंध नहीं है, जिसका अर्थ है कि एजेंट RAG API जैसी आंतरिक घटकों तक भी पहुंच सकते हैं, जो डिफ़ॉल्ट Docker Compose सेटअप में शामिल है। इस समस्या को संस्करण 0.8.1-rc2 में ठीक किया गया है।

The SSRF vulnerability in LibreChat allows an attacker to craft malicious agent instructions that trigger requests to arbitrary internal or external resources. Because the Actions feature lacks input validation, an attacker can bypass intended security boundaries and directly access the RAG API, potentially exposing sensitive data used for generating responses. This could include internal database credentials, API keys, or proprietary data. Furthermore, the attacker could leverage the SSRF to scan internal networks, identify other vulnerable services, and potentially pivot to other systems within the infrastructure, significantly expanding the attack surface. The lack of restrictions makes this a high-impact vulnerability, similar to scenarios where SSRF is used to access cloud metadata services.

Organizations deploying LibreChat within Docker containers, particularly those with exposed internal APIs or sensitive data accessible via the RAG API, are at significant risk. Shared hosting environments where LibreChat instances share resources with other applications are also vulnerable, as a successful exploitation could potentially impact other tenants.

• docker: Inspect Docker container network configuration for excessive outbound access.

docker inspect <container_id> | grep NetworkSettings

• linux / server: Monitor system logs for unusual outbound HTTP requests originating from the LibreChat container.

journalctl -u librechat -f | grep -i "http://"

• generic web: Monitor access logs for requests to internal services from the LibreChat server's IP address. Look for unusual user-agent strings or request patterns.

grep "<librechat_ip>" /var/log/apache2/access.log

1. 2026-01-07Disclosure

   disclosure

1. आरक्षित2025-12-29
2. प्रकाशित2026-01-07
3. संशोधित2026-01-15
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-69222 is to upgrade to a patched version of LibreChat as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. Restrict network access to the LibreChat container using Docker network policies or firewall rules to limit its ability to reach internal resources. Carefully review and restrict the permissions granted to LibreChat agents, minimizing their access to sensitive APIs and data. Implement a Web Application Firewall (WAF) with SSRF protection rules to filter outbound requests and block malicious patterns. Monitor LibreChat logs for unusual outbound requests that could indicate exploitation attempts.