LibreChat is an enhanced ChatGPT clone that supports multiple AI providers

CVE-2026-54029 is a missing-authorization flaw (CWE-862) in LibreChat — the popular open-source ChatGPT-clone front-end that supports multiple AI providers (OpenAI, Anthropic, Bedrock, Azure, local models). The bug sits in the same family as the recent run of LibreChat agent/file access-control advisories (CVE-2026-54027, CVE-2026-44653, CVE-2025-69220/21/22): a backend route accepts an object identifier (an agent, conversation, preset, or file resource) and acts on it without checking that the requesting user actually owns or has EDIT rights on that object. An authenticated user who knows or guesses an ID belonging to another tenant can mutate that object — corrupting agent instructions, swapping tool wiring, or polluting shared resources. The CVSS vector AV:N/AC:H/PR:L/UI:N/C:N/I:H/A:N confirms the shape: network-reachable, requires a real account, high attack complexity (you need a valid target ID), no confidentiality or availability impact, integrity-only.

The vendor's MEDIUM (5.3) is about right for the typical deployment. LibreChat is overwhelmingly self-hosted as a personal or small-team frontend; in the single-tenant case the only person who can exploit this is *yourself*, which is meaningless. The CVSS becomes interesting only in multi-tenant deployments — internal corporate LibreChat instances exposing dozens or hundreds of accounts to each other. Even there, the impact ceiling is *tenant-scoped data tampering*, not RCE, not credential theft, not lateral movement. No EPSS signal (0.00153), no KEV, no in-the-wild reports. We are leaving this at MEDIUM.

Why this verdict

• Authentication required (PR:L): the attacker must hold a valid LibreChat session before any of this matters. On SSO-backed corporate deployments this gates the population to internal users only.
• AC:H is real here, not theatre: exploitation requires knowing the victim's object ID, which is not directly enumerable; it requires either social/marketplace disclosure or chaining a separate ID-leak bug.
• Integrity-only impact: no confidentiality, no availability, no code execution. The blast radius is bounded to data inside the affected LibreChat tenant.
• Role multiplier: LibreChat is a self-hosted AI chat UI. Across the realistic role spectrum — (a) single-user hobbyist deployment: self-exploit only, irrelevant; (b) small team / family deployment: trivial trust model, low impact; (c) corporate multi-tenant deployment: meaningful but tenant-scoped tampering. No high-value-role variant exists for LibreChat itself — it doesn't issue tokens, hold keys for other systems, or sit in the trust path of identity, build, or backup planes. Floor does not engage.
• Threat intel is quiet: EPSS 0.00153, no KEV, no public PoC, no GreyNoise tags. There is no reason to short-fuse this.

Why not higher?

Not HIGH because the chain caps at tenant-scoped integrity tampering with no path to RCE, credential theft, or cross-tenant compromise of the host or downstream provider APIs. The AI provider keys live in environment variables on the server, not in user-mutable objects, so this bug does not bridge to the OpenAI/Anthropic billing surface.

Why not lower?

Not LOW because in real multi-tenant LibreChat deployments — increasingly common in mid-size companies standing up internal AI portals — an authenticated insider can silently poison shared agents to drive prompt-injection and social-engineering outcomes against colleagues. That is a real and exploitable harm, just not a fleet-scale one.

1. Disable open user registration — Set ALLOW_REGISTRATION=false and ALLOW_SOCIAL_REGISTRATION=false in .env, then force SSO/SAML or invite-only flows. This collapses the attacker population from internet-wide to your authenticated user base. Apply immediately as part of standard hardening — no formal mitigation SLA at MEDIUM, but this should already be your baseline.
2. Front the instance with an authenticating reverse proxy — Place LibreChat behind Cloudflare Access, Tailscale, oauth2-proxy, or an IdP-fronted ingress so that even reaching the vulnerable route requires a corporate identity. This is the highest-leverage mitigation while waiting on the official patch.
3. Enable application-level mutation auditing — Add a Mongoose pre('findOneAndUpdate') hook that logs actor_user_id vs. resource.author_id mismatches to a SIEM. Alert on any mismatch. This gives you both detection for current attempts and a forensic trail once the GHSA confirms the affected route.
4. Upgrade as soon as the patched 0.8.x release ships — Subscribe to the danny-avila/LibreChat GitHub release feed and pin the container image to a release channel you can roll forward in hours. Target the noisgate remediation SLA of 365 days for MEDIUM but realistically you should rebase within the next monthly maintenance window.
5. Audit shared agents and presets for unexpected changes — Export the agents/presets MongoDB collections and diff updatedAt timestamps against createdAt and known-good owner activity. Anything mutated by a non-owner is suspect.

Run on a host that can reach your LibreChat instance (auditor workstation or admin jumpbox). Usage: ./check_librechat_54029.sh https://chat.corp.example.com. No privileges required beyond network egress to the target. Checks the running version via the /api/config endpoint against the known-vulnerable cohort.

#!/usr/bin/env bash
# noisgate verification — CVE-2026-54029 (LibreChat missing authorization)
# Compares the live /api/config version against the known-vulnerable cohort.
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 https://librechat.example.com" >&2
  exit 2
fi

# Fixed-version threshold. Update once the official GHSA publishes the
# exact patched release; floor here is the conservative pre-patch ceiling.
FIXED_AT="0.8.2"

ver_lt() {
  # returns 0 if $1 < $2 (semver-ish, ignores -rc tags)
  printf '%s\n%s\n' "$1" "$2" | sort -V -C
  [[ "$1" != "$2" ]]
}

CONFIG_JSON=$(curl -fsSL --max-time 10 "${TARGET%/}/api/config" 2>/dev/null || true)
if [[ -z "$CONFIG_JSON" ]]; then
  echo "UNKNOWN: could not retrieve /api/config from $TARGET"
  exit 3
fi

VERSION=$(printf '%s' "$CONFIG_JSON" | grep -oE '"version"\s*:\s*"[^"]+"' | head -1 | sed -E 's/.*"([^"]+)"/\1/')
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: /api/config did not expose a version field"
  exit 3
fi

VCLEAN="${VERSION%%-*}"
if ver_lt "$VCLEAN" "$FIXED_AT"; then
  echo "VULNERABLE: LibreChat $VERSION < $FIXED_AT"
  exit 1
else
  echo "PATCHED: LibreChat $VERSION >= $FIXED_AT"
  exit 0
fi

Sources

1. LibreChat GitHub Security Advisories
2. LibreChat — CVE-2026-54027 (sibling auth-bypass in same cohort)
3. LibreChat MCP & Access Control vulnerabilities write-up
4. LibreChat Insufficient Access Control on Agent Permission Queries (GHSA-5ccx-4r3h-9qc7)
5. LibreChat Insufficient Access Control on Agent Files (GHSA-xcmf-rpmh-hg59)
6. CWE-862: Missing Authorization
7. OpenCVE — LibreChat vendor CVE listing
8. FIRST EPSS model