Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools

LibreChat

Source -

CNA

BOS Name -

N/A

CNA CVEs -

2

ADP CVEs -

0

CISA CVEs -

0

NVD CVEs -

0
Related CVEsRelated ProductsRelated AssignersReports
2Vulnerabilities found
CVE-2026-33265
Assigner-MITRE Corporation
ShareView Details
Assigner-MITRE Corporation
CVSS Score-6.3||MEDIUM
EPSS-0.23% / 13.86%
||
7 Day CHG~0.00%
Published-18 Mar, 2026 | 11:17
Updated-24 Mar, 2026 | 18:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.

Action-Not Available
Vendor-librechatLibreChat
Product-librechatLibreChat
CWE ID-CWE-669
Incorrect Resource Transfer Between Spheres
CVE-2026-4276
Assigner-CERT/CC
ShareView Details
Assigner-CERT/CC
CVSS Score-7.5||HIGH
EPSS-0.28% / 19.27%
||
7 Day CHG~0.00%
Published-16 Mar, 2026 | 15:31
Updated-05 Jun, 2026 | 19:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.

LibreChat RAG API, version 0.7.0, contains a log-injection vulnerability that allows attackers to forge log entries.

Action-Not Available
Vendor-librechatLibreChat
Product-librechatRAG API
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')