CVE-2026-33265
Published: 18 March 2026
Summary
CVE-2026-33265 is a medium-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Librechat Librechat. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 13.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement).
Deeper analysis
CVE-2026-33265 is a vulnerability in LibreChat version 0.8.1-rc2, where a logged-in user obtains a JWT token valid for both the LibreChat API and the RAG API. This issue, published on 2026-03-18, carries a CVSS v3.1 base score of 6.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) and maps to CWE-669 (Incorrect Resource Transfer Between Spheres), indicating improper handling of authentication credentials across API boundaries.
The attack requires a local, low-privileged adversary, such as an authenticated user, who can exploit it with low complexity and no user interaction. Exploitation changes the scope and enables limited impacts on confidentiality, integrity, and availability, likely through unauthorized access enabled by the shared JWT validity.
Advisories provide further details on mitigation; refer to the SBA Research advisory at https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251205-01_LibreChat_RAG_API_Authentication_Bypass, which addresses the RAG API authentication bypass, and the OSS-Security mailing list announcement at https://www.openwall.com/lists/oss-security/2026/03/18/3.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12813
Vulnerability details
In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: librechat
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The auth bypass allows a low-privileged logged-in user to misuse a legitimately obtained JWT for unauthorized RAG API access (scope change), directly enabling exploitation for privilege escalation and use of application access tokens as alternate authentication material.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for information flow between the LibreChat API and RAG API spheres, directly preventing incorrect resource transfer via shared JWT tokens.
Mandates enforcement of access control policies at each API, blocking unauthorized access enabled by JWT validity across boundaries.
Applies least privilege to restrict JWT scopes to only the intended API, mitigating over-privileging that allows exploitation across APIs.