CVE-2026-33265
Librechat 0.8.1
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LSummary
CVE-2026-33265 is a medium-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Librechat Librechat. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33265 is a vulnerability in LibreChat version 0.8.1-rc2, where a logged-in user obtains a JWT token valid for both the LibreChat API and the RAG API. This issue, published on 2026-03-18, carries a CVSS v3.1 base score of 6.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) and maps to CWE-669 (Incorrect Resource Transfer Between Spheres), indicating improper handling of authentication credentials across API boundaries.
The attack requires a local, low-privileged adversary, such as an authenticated user, who can exploit it with low complexity and no user interaction. Exploitation changes the scope and enables limited impacts on confidentiality, integrity, and availability, likely through unauthorized access enabled by the shared JWT validity.
Advisories provide further details on mitigation; refer to the SBA Research advisory at https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251205-01_LibreChat_RAG_API_Authentication_Bypass, which addresses the RAG API authentication bypass, and the OSS-Security mailing list announcement at https://www.openwall.com/lists/oss-security/2026/03/18/3.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12813
Vulnerability Data
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: librechat
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved information flow authorizations between system components and connected systems, directly stopping improper resource transfers across spheres.
Prevents unintended information leakage through shared system resources when crossing sphere boundaries.
Monitors and controls communications at external and key internal boundaries to block unauthorized transfers between trust domains.
Enforces logical access authorizations that limit resource transfers to only approved sphere crossings.
Separates user functionality from system management functions to avoid improper resource or behavior transfer between privilege spheres.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Least-privilege authorization policies directly constrain resource transfers across security domains.
Protecting data-in-transit can limit exposure during inter-sphere transfers but does not address control-flow or authorization errors.
Logical segmentation and access controls reduce unintended cross-sphere resource movement.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Environment separation limits unintended resource leakage between spheres.
Information-transfer rules can prevent improper resource hand-off between spheres.
Access-control policies limit unintended control over transferred resources.
Managing access rights reduces risk of unauthorized resource transfer.
Network-security controls can block improper cross-sphere transfers.
Network segregation directly limits unintended resource movement between spheres.