CVE-2026-33265: 
NixOS vulnerability analysis and mitigation

CVE-2026-33265 is a RAG API authentication bypass vulnerability in LibreChat 0.8.1-rc2 that allows any authenticated user to reuse their LibreChat session JWT to directly access the internal RAG (Retrieval-Augmented Generation) API, bypassing its service-level authentication. The vulnerability stems from LibreChat and the RAG API sharing the same JWT_SECRET, with no audience scoping or token restrictions to differentiate between the two services. It was identified on 2025-12-05 by SBA Research, disclosed to the vendor on 2025-12-17, and publicly disclosed on 2026-03-18. The CVSS v3.1 base score is 9.0 (Critical) per Feedly/NVD assessment (SBA Advisory, oss-security).

The root cause is classified as CWE-669 (Incorrect Resource Transfer Between Spheres): LibreChat's recommended Docker Compose deployment configures both the LibreChat API and the RAG API to use the same JWT_SECRET environment variable, and the issued JWT tokens contain no audience (aud) claim or other scope restriction. When a user logs in via POST /api/auth/login, LibreChat returns a short-lived JWT intended for UI-to-API communication; because the RAG API validates tokens using the same secret without any additional checks, this user-facing token is accepted as a valid service credential by the RAG API. The attack vector is adjacent network (AV:A), requiring low privileges (an authenticated LibreChat account) and no user interaction. A full proof-of-concept using curl commands is publicly available, demonstrating the bypass against the RAG API /ids endpoint (SBA Advisory, oss-security).

A successful exploit grants an authenticated attacker full access to all RAG API endpoints, enabling them to read, replace, delete, or upload documents stored in the RAG backend — including potentially sensitive files used to augment AI responses. Because the RAG API provides only service-level authentication with no per-user access control, any authenticated LibreChat user can act with the same privileges as the internal service account. The scope is changed (S:C), with high confidentiality, integrity, and availability impact, meaning an attacker could corrupt or exfiltrate the entire RAG document store (SBA Advisory, oss-security).

Public proof-of-concept exploit code is available via SBA Research's GitHub advisory and the oss-security mailing list, with concrete curl commands demonstrating the full attack flow (SBA Advisory, oss-security). There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.013% (0.000130), indicating low current exploitation probability. The LibreChat maintainer noted that in the default deployment, the RAG API is no longer externally reachable due to SSRF fixes applied in March 2026, which reduces but does not eliminate risk for non-default or custom deployments (oss-security).

1. Obtain a LibreChat account: Register or use an existing low-privilege account on the target LibreChat 0.8.1-rc2 instance.
2. Authenticate and capture the JWT: Send a login request to the LibreChat API and extract the returned token value:

POST /api/auth/login HTTP/1.1
Host: <librechat-host>:3080
Content-Type: application/json

{"email":"attacker@example.com","password":"password"}

The response JSON contains a token field — this is the LibreChat session JWT. 3. Identify the RAG API endpoint: In a standard Docker Compose deployment, the RAG API listens on an internal network address (e.g., 172.18.0.5:8000). Gain access to the adjacent network segment (e.g., via another container, internal network access, or a combined SSRF vulnerability). 4. Bypass RAG API authentication: Use the captured LibreChat JWT as a Bearer token against the RAG API:

curl -v -H "Authorization: Bearer <librechat_jwt>" http://172.18.0.5:8000/ids

The RAG API accepts the token and returns a 200 OK with document IDs. 5. Exploit full RAG API access: With authenticated access, perform unauthorized operations — enumerate stored documents (GET /ids), read document contents, upload malicious documents, replace existing documents, or delete the entire document store using available RAG API endpoints (SBA Advisory, oss-security).

• Network: Unexpected HTTP requests originating from non-service hosts to the RAG API port (default 8000) on the internal Docker network; GET /ids or other RAG API endpoint requests from IP addresses that are not the LibreChat backend container.
• Logs: RAG API access logs (uvicorn) showing 200 OK responses to /ids, /upload, or document management endpoints from unexpected source IPs or at unusual times; LibreChat auth logs showing login events followed immediately by direct RAG API access patterns.
• Network: Bearer tokens in RAG API requests that decode to user-facing JWT payloads (containing username, email, provider fields) rather than service-level tokens — these indicate token reuse from the LibreChat UI session.
• File System: Unexpected new or modified documents in the RAG vector store; missing documents that were previously indexed, indicating deletion or replacement activity (SBA Advisory, oss-security).

No official patch was available at the time of public disclosure (2026-03-18); users should monitor the LibreChat project for a fixed release. As interim mitigations, SBA Research recommends: (1) configuring a separate JWT_SECRET for the RAG API service, distinct from the LibreChat user session secret; (2) adding JWT audience (aud) claims to tokens issued by LibreChat and enforcing audience validation in both LibreChat and the RAG API; (3) using separate environment files per service in Docker Compose so the RAG API does not have access to the LibreChat JWT secret; and (4) ensuring the RAG API is not network-accessible from untrusted hosts by enforcing strict Docker network segmentation. The maintainer noted that default deployments may be less exposed following SSRF fixes, but custom or non-default deployments remain at risk (SBA Advisory, oss-security).

The vulnerability was discovered and disclosed by Lisa Gnedt and Michael Koppmann of SBA Research, with support from the CYSSDE project and the European Union. The LibreChat maintainer initially closed the GitHub Security Advisory (GHSA-47h3-3457-xwpv) in March 2026, asserting the vulnerability was no longer externally exploitable in the default deployment due to SSRF mitigations — a position that SBA Research disputed by proceeding with public disclosure. The disclosure was published to the oss-security mailing list on 2026-03-18 and has been tracked by multiple vulnerability databases including ENISA EUVD (EUVD-2026-12813) and Red Hat's CVE tracker (oss-security, SBA Advisory).