CVE-2025-69222: 
NixOS vulnerability analysis and mitigation

CVE-2025-69222 is a Server-Side Request Forgery (SSRF) vulnerability in LibreChat, an open-source AI chat platform, affecting versions 0.8.1 and 0.8.1-rc1. The flaw exists in the Actions feature, which allows users to configure agents that interact with remote services via OpenAPI specifications, but imposes no restrictions on accessible targets by default. This enables authenticated low-privileged users to direct agents to make requests to internal services, including the RAG API bundled in the default Docker Compose setup. The vulnerability was discovered on December 5, 2025, disclosed to the vendor on December 17, 2025, and publicly disclosed on January 7, 2026, with a fix released the same day. It carries a CVSSv3.1 base score of 9.1 (Critical) per the GitHub Security Advisory (GitHub Advisory), and 8.1 (High) per NVD (Red Hat CVE).

The root cause is CWE-918 (Server-Side Request Forgery), where the Actions feature processes user-supplied OpenAPI specifications to make outbound HTTP requests without validating or restricting the target destinations (GitHub Advisory). The actions.allowedDomains configuration option exists but defaults to an empty list, which was interpreted as "allow all" rather than "deny all," leaving internal services fully accessible. An additional bypass exists in the domain validation logic: the UI rejects http:// URLs due to a protocol mismatch check, but an attacker can circumvent this by manipulating the domain parameter in the raw API request to include the http:// prefix (e.g., "domain": "http://rag_api"), allowing the internal RAG API at http://rag_api:8000/ to be targeted. The fix, applied in commit 3b41e39, changes the default behavior so that when allowedDomains is empty, SSRF targets (localhost, private IPs, .internal/.local TLDs) are blocked by default (GitHub Commit).

A successful exploit allows an authenticated attacker with low privileges to interact with arbitrary internal or external HTTP services through the LibreChat server, effectively using it as a proxy. In the default Docker Compose deployment, this includes full access to the internal RAG API — enabling the attacker to enumerate, read, delete, or potentially replace documents uploaded by other users, including those belonging to other accounts (GitHub Advisory). Because the RAG API shares the same JWT secret as LibreChat, a valid user session token can be reused to authenticate against the RAG API directly. Beyond the RAG API, the attacker can reach any other internal service accessible from the server, with impact ranging from information disclosure to full internal service compromise depending on the deployment environment.

There is no public proof-of-concept exploit code beyond the detailed technical write-up in the GitHub Security Advisory, which includes a working HTTP request payload demonstrating the bypass (GitHub Advisory). No in-the-wild exploitation has been reported, and no threat actor attribution is available. The EPSS score is approximately 0.086% (low probability of near-term exploitation) (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though CISA referenced it in a weekly vulnerability bulletin (CISA Bulletin). Exploitation requires a valid (low-privileged) user account and the ability to create or modify agents with custom actions.

1. Authenticate: Log in to a LibreChat instance as any low-privileged user to obtain a valid session JWT token.
2. Create an agent: Navigate to the agent creation interface and create a new agent (or use an existing one) that supports the Actions feature.
3. Craft a malicious OpenAPI spec: Prepare a minimal OpenAPI specification targeting an internal service, such as the RAG API:

   servers:
     - url: http://rag_api:8000/
   paths:
     /openapi.json:
       get: {}

4. Bypass the UI domain validation: Instead of using the UI (which rejects http:// URLs), send a direct API request to the agent actions endpoint, setting the domain field to include the protocol prefix (e.g., "domain": "http://rag_api") to bypass the mismatch check:

   POST /api/agents/actions/<agent_id> HTTP/1.1
   Authorization: Bearer <session_token>
   Content-Type: application/json
   {"action_id":"...","metadata":{"raw_spec":"<yaml_spec>","domain":"http://rag_api"},...}

5. Invoke the agent: Use the configured agent in a chat session and instruct it to call the defined action endpoints.
6. Access internal services: The agent will make server-side HTTP requests to the internal RAG API (or other internal targets), returning responses to the attacker — enabling document enumeration, data exfiltration, deletion, or further internal reconnaissance (GitHub Advisory).

• Network: Outbound HTTP requests from the LibreChat server process to internal hostnames such as rag_api, localhost, or RFC-1918 IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) on non-standard ports; unexpected connections to the RAG API port (default 8000) originating from the LibreChat application container.
• Logs: LibreChat API logs showing POST /api/agents/actions/<agent_id> requests with domain values containing http:// prefixes pointing to internal hostnames; agent invocation logs showing tool calls to internal service endpoints (e.g., get_openapijson, get_health against rag_api).
• Application Behavior: Unusual agent configurations with OpenAPI specs referencing internal Docker network hostnames (e.g., rag_api, host.docker.internal) or private IP addresses; agents with custom authentication headers reusing LibreChat session tokens against internal APIs.
• RAG API Logs: Unexpected authenticated requests to the RAG API from the LibreChat server IP, particularly to document listing, retrieval, or deletion endpoints, using JWT tokens belonging to regular (non-admin) users (GitHub Advisory).

Upgrade LibreChat to version 0.8.2-rc2 or later, which changes the default behavior so that an empty allowedDomains list blocks SSRF targets (localhost, private IPs, .internal/.local TLDs) rather than allowing all (GitHub Release, GitHub Commit). For deployments that cannot immediately upgrade, explicitly configure actions.allowedDomains in librechat.yaml to a non-empty list of permitted external domains, which will block all unlisted targets. Additionally, implement network-level controls (e.g., Docker network segmentation, firewall rules) to prevent the LibreChat container from reaching internal services like the RAG API directly. If the Actions feature is not required, disable it entirely, and apply the principle of least privilege to restrict which users can create or modify agents with custom actions (GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by Lisa Gnedt and Michael Koppmann of SBA Research (identifier SBA-ADV-20251205-02), who published a detailed security advisory on January 8, 2026 (SBA Research). The vendor (danny-avila) responded promptly, confirming the vulnerability on December 29, 2025, and releasing a fix on January 7, 2026 — the same day as public disclosure. The issue received coverage in security news aggregators and was referenced in CISA's weekly vulnerability bulletin for the week of January 5, 2026 (CISA Bulletin). Check Point also added detection coverage for this CVE (Check Point Advisory).