CVE-2026-31943

HIGH EPSS 11.6%
Published Mar 27, 20263mo ago · Modified Jun 17, 20262w ago
8.5 CVSS 3.1
High
Find Similar
Published Mar 27, 2026 3mo ago
Last Modified Jun 17, 2026 2w ago

Description

LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth/domain.ts` fails to detect IPv4-mapped IPv6 addresses in their hex-normalized form, allowing any authenticated user to bypass SSRF protection and make the server issue HTTP requests to internal network resources — including cloud metadata services (e.g., AWS `169.254.169.254`), loopback, and RFC1918 ranges. Version 0.8.3 fixes the issue.

CVSS Details

Base Score
8.5
Exploitability
3.1
Impact
4.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality High
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
11.6% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 3

VendorProductVersionRange
librechatlibrechat* <0.8.3
librechatlibrechat0.8.3any
librechatlibrechat0.8.3any

References 1

  • github.com https://github.com/danny-avila/LibreChat/security/advisories/GHSA-w5r7-4f94-vp4c
    ExploitVendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.