CVE-2026-31945: 
NixOS vulnerability analysis and mitigation

CVE-2026-31945 is a Server-Side Request Forgery (SSRF) vulnerability in LibreChat, an open-source ChatGPT-like platform, affecting versions 0.8.2-rc2, 0.8.2-rc3, and 0.8.2. The flaw exists in the agent actions and MCP (Model Context Protocol) functionality, where a prior SSRF patch (GHSA-rgjq-4q58-m3q8) introduced hostname validation but failed to verify whether DNS resolution of a hostname results in a private IP address. This bypass allows authenticated attackers to reach internal resources such as cloud instance metadata endpoints. It was published on March 27, 2026, with a patch available in version 0.8.3-rc1. The CVSS v3.1 base score is 7.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is CWE-918 (Server-Side Request Forgery), specifically an incomplete fix in the isDomainAllowedCore and isSSRFTarget methods within packages/api/src/auth/domain.ts. These methods validate hostnames against known private IP patterns and localhost-like names, but do not perform DNS resolution to check whether the resolved IP falls within a private range. An attacker can exploit this by supplying a domain such as 169.254.169.254.nip.io — a wildcard DNS service that resolves to the AWS EC2 link-local metadata IP 169.254.169.254 — as the server URL in an OpenAPI specification used by an agent action. Alternatively, an attacker can operate a custom DNS nameserver that returns a private IP for an attacker-controlled domain. The advisory also notes that the preliminary DNS-resolution-based fix is susceptible to TOCTOU (Time-of-Check to Time-of-Use) attacks, requiring validation at the point of the outbound axios request as well (GitHub Advisory).

Successful exploitation allows any authenticated user with access to agent actions or MCP to make the LibreChat server issue requests to internal network resources that would otherwise be inaccessible. In cloud environments (e.g., AWS EC2), this enables retrieval of instance metadata including IAM credentials, AMI IDs, and other sensitive configuration data via the IMDSv2 endpoint. The confidentiality impact is high, as internal APIs (such as a RAG API) and cloud metadata services can be fully accessed; there is no integrity or availability impact. Compromised cloud credentials could enable lateral movement within the cloud environment (GitHub Advisory, Feedly).

A proof-of-concept (PoC) with detailed reproduction steps is publicly available in the GitHub Security Advisory, including a specific OpenAPI specification payload and a sequence of HTTP requests (PUT for IMDSv2 token, then GET for metadata retrieval) demonstrating successful credential theft from AWS EC2 metadata endpoints (GitHub Advisory). Exploitation requires low privileges (an authenticated user account) and no user interaction. There is no current evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.028% (0.000280), indicating low but non-zero probability of exploitation in the near term.

1. Authenticate to LibreChat: Obtain a valid user account on a LibreChat instance running version 0.8.2-rc2 through 0.8.2 with agent actions or MCP enabled.
2. Create an agent: Navigate to the agent creation interface and set up a new agent that supports custom actions.
3. Define a malicious OpenAPI action: Craft an OpenAPI specification that sets the server URL to http://169.254.169.254.nip.io (or a custom attacker-controlled domain that resolves to a private IP). This domain resolves to the AWS EC2 link-local metadata IP 169.254.169.254 via the nip.io wildcard DNS service.
4. Obtain an IMDSv2 token: Use the agent action to issue a PUT request to http://169.254.169.254.nip.io/latest/api/token with the header X-aws-ec2-metadata-token-ttl-seconds: 21600. The LibreChat server will forward this request to the metadata endpoint and return the session token.
5. Retrieve sensitive metadata: Use the obtained token in a subsequent GET request (e.g., to /latest/meta-data/ami-id or /latest/meta-data/iam/security-credentials/) via the agent action to retrieve EC2 instance metadata, including IAM role credentials.
6. Abuse retrieved credentials: Use the exfiltrated IAM credentials for lateral movement within the AWS environment, accessing S3 buckets, EC2 APIs, or other cloud resources (GitHub Advisory).

• Network: Outbound HTTP requests from the LibreChat server to 169.254.169.254 or other RFC 1918/link-local addresses (e.g., 172.16.0.0/12, 10.0.0.0/8, 192.168.0.0/16); DNS queries for domains ending in .nip.io resolving to private IP ranges; unusual PUT requests to metadata endpoints.
• Logs: LibreChat application logs showing agent action requests with server URLs containing nip.io or other wildcard DNS services; HTTP requests to /latest/api/token or /latest/meta-data/ paths originating from the LibreChat process; repeated requests iterating through 172.16.x.x private IP ranges (brute-force internal service discovery).
• File System: Unexpected OpenAPI specification files referencing internal IP addresses or wildcard DNS domains stored in agent configurations.
• Process: The LibreChat Node.js process initiating outbound connections to 169.254.169.254 or other private IP addresses not in the configured allowedDomains list (GitHub Advisory).

Upgrade LibreChat to version 0.8.3-rc1 or later, which contains a patch that adds DNS resolution verification to check whether a hostname resolves to a private IP address before allowing outbound requests (GitHub Advisory). As a network-level workaround, implement egress filtering to block outbound connections from the LibreChat application to private IP ranges (RFC 1918, link-local 169.254.0.0/16) and cloud metadata endpoints. Additionally, explicitly configure the actions.allowedDomains setting in librechat.yaml to restrict agent actions to only trusted, known-good external domains, which limits the attack surface even on unpatched versions.