LibreChat MCP credential placeholder substitution -> OAuth token exfiltration
Date: 2026-02
Affected: LibreChat 0.8.2-rc1 - 0.8.3-rc1
Attack vector: info-disclosure
Category: real-world
Severity: High
CVE: CVE-2026-31951
CWE: CWE-200
CVSS: 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N)

LibreChat 0.8.2-rc1 through 0.8.3-rc1: user-created MCP servers can include arbitrary HTTP headers that undergo credential placeholder substitution. A malicious MCP server with headers like '{{LIBRECHAT_OPENID_ACCESS_TOKEN}}' causes any user calling tools on that server to exfiltrate their OAuth tokens.


Mitigations:

Architectural layers (MAESTRO):