In LibreChat versions up to and including 0.8.3, the MCP server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. This allows any authenticated user to craft a malicious MCP server configuration with a URL referencing environment variables. When the server connects to this URL, it transmits sensitive secrets such as CREDS_KEY, CREDS_IV, JWT_SECRET, and MONGO_URI in the request URL, exposing critical cryptographic materials and database credentials. This vulnerability is tracked as CVE-2026-32625 and is fixed in version 0.8.4-rc1.

The vulnerability exposes highly sensitive environment variables containing cryptographic keys and database credentials to unauthorized actors. This can lead to full compromise of the LibreChat installation's cryptographic materials and database access. The attack requires only authenticated user privileges, significantly lowering the barrier for exploitation. There is no indication of denial of service or integrity impact, but confidentiality is severely affected.

Upgrade LibreChat to version 0.8.4-rc1 or later, where this vulnerability is patched. Until upgrading, restrict authenticated user capabilities to prevent creation of malicious MCP server configurations. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the description confirms the issue is fixed in 0.8.4-rc1. Monitor vendor advisories for any additional updates.