CVE-2026-31945

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-31945 is a server-side request forgery (SSRF) vulnerability affecting LibreChat, an open-source ChatGPT clone with additional features, specifically in versions 0.8.2-rc2 through 0.8.2. The issue arises when using agent actions or MCP, where a prior SSRF fix (GHSA-rgjq-4q58-m3q8) implemented only hostname validation without checking if DNS resolution yields a private IP address. This allows attackers to bypass protections and access internal resources, such as an internal RAG API or cloud instance metadata endpoints. The vulnerability is rated 7.7 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and maps to CWE-918.

An attacker with low privileges, such as an authenticated user, can exploit this over the network with low complexity and no user interaction required. By crafting requests through agent actions or MCP, they can force the server to make unauthorized connections to internal services, achieving high confidentiality impact across a changed scope. Potential outcomes include exfiltration of sensitive data from internal APIs or metadata services on cloud instances.

The GitHub security advisory (GHSA-f92m-jpv7-55p2) confirms the patch in version 0.8.3-rc1, which addresses the incomplete SSRF mitigation by adding private IP validation post-DNS resolution. Security practitioners should upgrade to 0.8.3-rc1 or later and review configurations for agent actions and MCP usage.

LibreChat's nature as an AI chatbot platform highlights relevance to AI/ML deployments, where SSRF could expose retrieval-augmented generation (RAG) components or related internal services. No public evidence of real-world exploitation is noted as of the CVE publication on 2026-03-27.