CVE-2025-41258: 
NixOS vulnerability analysis and mitigation

CVE-2025-41258 is an improper access control vulnerability in LibreChat version 0.8.1-rc2 that allows authenticated users to bypass service-level authentication of the RAG (Retrieval-Augmented Generation) API by reusing their user session JWT token. The vulnerability stems from LibreChat using the same JWT_SECRET environment variable for both user session management and RAG API authentication. It was identified on 2025-12-05, disclosed to the vendor on 2025-12-17, and publicly disclosed on 2026-03-18 by SBA Research, who assigned CVE-2025-41258. It carries a CVSS v3.1 base score of 8.0 (High) (SBA Advisory).

The root cause is classified as CWE-284 (Improper Access Control): LibreChat's recommended Docker Compose deployment shares a single JWT_SECRET across both the user-facing application and the internal RAG API service, with no audience claim validation or other token-scoping mechanism to differentiate between the two contexts. After a successful login, LibreChat issues a JWT token to the browser for accessing the LibreChat API; because the RAG API validates tokens using the same secret and performs no additional checks (e.g., audience, issuer, or scope), this user-facing token is accepted as valid by the RAG API. The attack vector is adjacent network (AV:A), requiring low privileges (a valid LibreChat account) and no user interaction. A public proof-of-concept with step-by-step HTTP requests and curl commands is available (SBA Advisory).

An authenticated LibreChat user can gain unauthorized full access to all RAG API endpoints, enabling them to read, replace, upload, and delete all documents stored in the RAG backend without proper authorization. Because the RAG API provides only service-level authentication with no per-user access controls, any authenticated user effectively gains administrative access to the RAG data store. This poses significant confidentiality, integrity, and availability risks to any documents or embeddings managed by the RAG API, which may include sensitive organizational data ingested for AI-assisted workflows (SBA Advisory).

A public proof-of-concept exploit with concrete curl commands and JWT tokens is available on GitHub, published by SBA Research at the time of public disclosure on 2026-03-18. No evidence of in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.032% (low probability of near-term exploitation), and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have a valid LibreChat account and adjacent network access to the RAG API endpoint, which is typically only accessible internally; the maintainer noted that SSRF fixes in later versions reduce external exploitability in the default deployment (SBA Advisory).

1. Obtain a LibreChat account: Register or log in to a LibreChat instance running version 0.8.1-rc2 using valid credentials.
2. Capture the session JWT: After login, intercept the HTTP response from POST /api/auth/login. Extract the token field from the JSON response body — this is the user-facing JWT signed with the shared JWT_SECRET.
3. Identify the RAG API endpoint: Determine the internal network address of the RAG API service (e.g., http://172.18.0.5:8000 in the default Docker Compose setup). This may require internal network access or exploitation of an SSRF vulnerability in older versions.
4. Authenticate against the RAG API: Use the captured JWT token as a Bearer token in requests to the RAG API:

   curl -v -H "Authorization: Bearer <user_jwt_token>" http://<rag_api_host>:8000/ids

5. Access RAG API endpoints: With authentication bypassed, enumerate stored document IDs via /ids, retrieve document content, upload new documents, replace existing ones, or delete them — all without any further authorization checks (SBA Advisory).

• Network: Unexpected HTTP requests originating from non-service hosts to the RAG API port (default 8000) bearing a Authorization: Bearer header; direct access to RAG API endpoints (e.g., /ids, document upload/delete endpoints) from IP addresses other than the LibreChat application server.
• Logs: RAG API access logs showing successful 200 OK responses to endpoints like /ids from user-associated JWT tokens (identifiable by the id claim matching a LibreChat user ID rather than a service account); unusual volume of document read, write, or delete operations in RAG API logs.
• File System: Unexpected or unauthorized documents appearing in or disappearing from the RAG API data store; new embeddings or document collections not associated with legitimate user activity.
• Process/Auth: LibreChat login events (POST /api/auth/login) followed shortly by direct RAG API access from the same source IP, bypassing normal application flow (SBA Advisory).

No official patch was confirmed at the time of public disclosure (2026-03-18); users should upgrade to a LibreChat version released after 0.8.1-rc2 that uses separate JWT secrets for user session management and the RAG API. As an immediate workaround, configure a distinct JWT_SECRET for the RAG API service using separate environment files for each Docker Compose service, ensuring the RAG API secret is not shared with the user-facing application. Additionally, implement JWT audience claims in both LibreChat and the RAG API to prevent token reuse across services, and restrict network access to the RAG API so it is only reachable from the LibreChat application server. Rotate any existing JWT secrets to invalidate tokens generated under the shared secret, and review RAG API access logs for signs of unauthorized access (SBA Advisory).

The vulnerability was discovered by Lisa Gnedt and Michael Koppmann of SBA Research, with research supported by CYSSDE and the European Union. The LibreChat maintainer responded to the private disclosure by stating that the vulnerability is no longer externally exploitable in the default deployment due to SSRF fixes introduced in later versions, and closed the GitHub Security Advisory (GHSA-47h3-3457-xwpv) on 2026-03-03 before SBA Research proceeded with public disclosure on 2026-03-18. No significant broader media coverage or social media discussion has been identified beyond the SBA Research advisory and standard vulnerability database entries (SBA Advisory).