CVE-2026-44653 LibreChat Shared MCP Server View Leaks Decrypted Admin Secrets

Medium 6.5 Published 2 Jun 2026 Updated 3 Jun 2026

Users with view access can retrieve decrypted admin secrets, exposing provider credentials in LibreChat.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-44653?

CVE-2026-44653 is a medium-severity vulnerability in Librechat Librechat, published on 2 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users with only `VIEW` access to an MCP server can retrieve the server's decrypted admin-managed secrets through `GET /api/mcp/servers` and `GET /api/mcp/servers/:serverName`. The returned config includes plaintext values for `apiKey.key` and `oauth.client_secret`. This allows viewers of a shared MCP server to exfiltrate the underlying provider credentials. Version 0.8..4 contains a patch. Other remediations include: never returning decrypted admin-managed secrets to non-owners; redacting apiKey.key and oauth.client_secret from all API responses consider returning only boolean presence indicators for secrets, similar to the auth-values route pattern; and, if owners need to edit configs without re-entering secrets, preserving secrets server-side and returning placeholders instead of plaintext.

Weakness: CWE-201

Which versions are affected by CVE-2026-44653?

It affects 1 product.

Products include Librechat Librechat.

How do I fix CVE-2026-44653?

No fix has been published for CVE-2026-44653 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-44653 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44653 exists.

All Librechat Librechat vulnerabilities

Sources

Also known as GHSA-6vqg-rgpm-qvf9.