--- title: "LibreChat MCP STDIO Command Injection to Root RCE - CVE-2026-22252" description: "CVE-2026-22252: a command injection in LibreChat's MCP STDIO transport lets any authenticated user run shell commands as root. Fixed in v0.8.2-rc2." url: "https://anomity.ai/blog/librechat-mcp-stdio-rce-cve-2026-22252/" source: html --- On this page - What happened - Why this is an agentic-endpoint risk - How Anomity surfaces and governs it - What to check across your fleet - Frequently asked questions [← Back to blog](https://anomity.ai/blog/) - Home - Blog - LibreChat MCP STDIO Command Injection to Root RCE - CVE-2026-22252 ![Anomity robot illustrating LibreChat MCP STDIO Command Injection to Root RCE - CVE-2026-22252] Advisory Critical # LibreChat MCP STDIO Command Injection to Root RCE - CVE-2026-22252 Anomity Research Anomity Threat Research · Feb 12, 2026 · 4 min read Share: Copied MCP Server Security · Critical · CVE-2026-22252 · Feb 12, 2026 Affected LibreChat prior to v0.8.2-rc2 ## What happened **CVE-2026-22252** is a critical command injection vulnerability in **LibreChat**, an open-source chat interface for large language models, affecting builds **prior to v0.8.2-rc2**. The flaw lives in LibreChat's MCP **STDIO transport**, which accepts an arbitrary command and arguments and passes them to the system shell without validation. Any authenticated user can craft an API request targeting the MCP STDIO endpoint and have that input interpreted directly as shell input. Because the application performs no sanitization or allowlisting of the supplied command, the request executes shell commands as **root inside the container**, resulting in full container compromise and a path to lateral movement. The issue was fixed in **v0.8.2-rc2**, which adds validation on the MCP STDIO transport. This is not an isolated bug. It is one of several independently reported instances of the same underlying STDIO execution pattern - the same shape appeared in MCP Inspector, WeKnora, and other projects. The common thread is an MCP transport that treats a user- or model-controlled command as something to run rather than something to validate, a pattern we cover in the [MCP Server Security guide](https://anomity.ai/blog/mcp-server-security-complete-guide/) and the sibling advisory on [MCP STDIO execution by design](https://anomity.ai/blog/anthropic-mcp-stdio-by-design-rce/). ## Why this is an agentic-endpoint risk MCP STDIO is the most common way an agent launches a local server: the client spawns a child process and speaks the protocol over standard input and output. That design assumes the command being spawned is trusted. CVE-2026-22252 breaks that assumption - an authenticated user, not an administrator, controls the command, and the host runs it as root. This is exactly the artifact layer [traditional controls were never built to see](https://anomity.ai/#compare): a legitimate application process spawning a child the way it is designed to, with the malicious intent encoded in configuration data rather than in network traffic or a known-bad binary. It is also a textbook case of [shadow AI on the endpoint](https://anomity.ai/blog/ai-agents-are-the-new-shadow-it/). LibreChat is installed bottom-up to give a team a usable chat front end, the MCP STDIO transport is enabled to wire in tools, and no one in security inventories which version is running or which accounts can reach the MCP configuration. The capability that turns a chat app into a root shell lives in a config surface that changes without review and is never attested. ## How Anomity surfaces and governs it Anomity treats MCP servers and the applications that host them as part of the [eight AI artifact types](https://anomity.ai/#features) it inventories on every managed endpoint. For each LibreChat instance it surfaces the exact version in use, so finding everything `prior to v0.8.2-rc2` becomes a single query rather than an incident-response sweep, and flags any MCP STDIO transport that can spawn commands without validation. On agents that expose a hook - for example the `PreToolUse` event in Claude Code - Anomity applies [runtime governance](https://anomity.ai/#runtime-governance), returning **allow**, **deny**, or **log** on each MCP tool call before it runs. A STDIO command that a CVE-2026-22252 injection attempt would trigger is evaluated against policy first, so an unexpected shell invocation can be denied rather than executed. Every install, version change, and decision lands in a [queryable 90-day audit trail](https://anomity.ai/#outcomes), giving responders a precise exposure window. Anomity collects metadata only, with on-endpoint secret redaction, so command arguments that contain credentials never leave the host. None of this replaces patching - upgrade to v0.8.2-rc2 - but it closes the window before and after the fix is deployed. > You can't govern what you can't see. The Anomity principle ## What to check across your fleet - Inventory every endpoint and container image for LibreChat and record its version; upgrade anything prior to v0.8.2-rc2 . - If you cannot upgrade immediately, restrict who can configure MCP servers and run the application without root inside the container. - Identify every account that can reach the MCP STDIO configuration endpoint and confirm least privilege - this flaw needs only an authenticated session. - Confirm no MCP STDIO transport accepts unvalidated commands or arguments from user-controlled input. - Review the audit trail for MCP STDIO command executions that fall outside normal tool workflows. - Add a policy: MCP servers must run as a non-root user and must validate or allowlist the commands their transport will spawn. This advisory is part of our [MCP Server Security guide](https://anomity.ai/blog/mcp-server-security-complete-guide/), which covers the full STDIO and unauthenticated-transport pattern, MCP trust tiers, and how to inventory and govern every server across your fleet. To see your own MCP posture - which instances are exposed, which transports spawn shells, and what [runtime governance](https://anomity.ai/#runtime-governance) would deny - [book a 30-minute demo](https://anomity.ai/#early-access). Share: Copied ## Frequently asked questions Am I affected by CVE-2026-22252? You are exposed if you run any LibreChat build prior to v0.8.2-rc2 with the MCP STDIO transport reachable to authenticated users. Because the flaw needs only a valid authenticated session - not an admin role - every account that can reach the MCP configuration endpoint is a potential entry point. The fix landed in v0.8.2-rc2, which adds validation on the STDIO transport. The practical first step is knowing where LibreChat runs across your fleet and which version each instance is on, which requires an inventory of AI tooling on every endpoint. What does the vulnerability allow? Any authenticated user can craft an API request targeting the MCP STDIO endpoint and have the supplied command and arguments interpreted directly as shell input. LibreChat performs no sanitization or allowlisting, so the command executes as root inside the container. That yields full container compromise and a foothold for lateral movement to whatever the container can reach - internal services, cloud metadata endpoints, and credentials mounted into the workload. How is CVE-2026-22252 related to other MCP STDIO flaws? It is one of several independently reported instances of the same underlying pattern: an MCP STDIO transport that accepts a command and arguments and passes them to the system shell without validation. The same execution pattern was reported in MCP Inspector, WeKnora, and others. Treating it as a single-product bug misses the point - STDIO transports that take user-controlled commands are a recurring class, which is why a fleet-wide policy on MCP execution matters more than patching one application. How does Anomity help with CVE-2026-22252? Anomity inventories AI tooling - including MCP servers and the applications that host them - across every managed endpoint and surfaces the version in use, so finding every vulnerable LibreChat instance is one query rather than a fleet hunt. On agents that expose a hook, it allows, denies, or logs each MCP tool call before it runs, so a STDIO command an injection attempt would trigger is evaluated against policy first. Every install, version change, and decision is recorded in a queryable 90-day audit trail. ## Related [Advisory Critical ### mcp-atlassian HTTP Auth Bypass Falls Back to Global Credentials - CVE-2026-77254 CVE-2026-77254 (CVSS 9.1): unauthenticated HTTP MCP requests to mcp-atlassian below 0.22.0 fall through to globally configured Jira/Confluence credentials. Sibling CVE-2026-77244 (CVSS 10.0) accepts any non-empty token. Anomity Research · Sep 28, 2026 · CVE-2026-77254 (CVSS 9.1, GHSA-vc8m-84rp-53hx); sibling CVE-2026-77244 (CVSS 10.0, GHSA-wrhw-j3f9-8vc6)](https://anomity.ai/blog/mcp-atlassian-http-auth-bypass-global-credentials-cve-2026-77254/) [Advisory Critical ### GitLab MCP CVE-2026-61568 - Streamable HTTP DNS Rebinding to Localhost CVE-2026-61568 (CVSS 9.6): @zereight/mcp-gitlab Streamable HTTP skipped SDK DNS-rebinding Host/Origin allowlists on loopback - fixed in 2.1.30. Anomity Research · Sep 21, 2026 · CVE-2026-61568 (CVSS 9.6, GHSA-vmp7-252j-cwp7)](https://anomity.ai/blog/mcp-gitlab-streamable-http-dns-rebinding-cve-2026-61568/) [Advisory Critical ### MySQL MCP Server CVE-2026-59971 - Unauthenticated SQL via SSE DNS Rebinding CVE-2026-59971 (CVSS 10.0): mysql-mcp-server SSE mode skipped Host/Origin DNS-rebinding protection, bound 0.0.0.0 with no auth - unauthenticated SQL until 0.4.2. Anomity Research · Sep 21, 2026 · CVE-2026-59971 (CVSS 10.0, GHSA-rqfv-2mw9-78g2)](https://anomity.ai/blog/mysql-mcp-server-sse-dns-rebinding-unauth-sql-cve-2026-59971/) ## Structured data ```json { "@context": "https://schema.org", "@type": "TechArticle", "headline": "LibreChat MCP STDIO Command Injection to Root RCE - CVE-2026-22252", "description": "CVE-2026-22252: a command injection in LibreChat's MCP STDIO transport lets any authenticated user run shell commands as root. Fixed in v0.8.2-rc2.", "datePublished": "2026-02-12", "dateModified": "2026-02-12", "author": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ] }, "publisher": { "@type": "Organization", "name": "Anomity", "url": "https://anomity.ai/", "sameAs": [ "https://www.linkedin.com/company/anomity", "https://github.com/Anomity-ai", "https://www.wikidata.org/wiki/Q140763940" ], "logo": { "@type": "ImageObject", "url": "https://anomity.ai/icon-512.png" } }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://anomity.ai/blog/librechat-mcp-stdio-rce-cve-2026-22252/" }, "image": { "@type": "ImageObject", "url": "https://anomity.ai/assets/blog/covers/prompt-injection.jpg", "width": 1200, "height": 630 }, "articleSection": "MCP Server Security", "url": "https://anomity.ai/blog/librechat-mcp-stdio-rce-cve-2026-22252/", "keywords": "LibreChat MCP RCE, CVE-2026-22252, MCP, remote code execution, CVE-2026-22252, LibreChat, command injection" } ``` ```json { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Am I affected by CVE-2026-22252?", "acceptedAnswer": { "@type": "Answer", "text": "You are exposed if you run any LibreChat build prior to v0.8.2-rc2 with the MCP STDIO transport reachable to authenticated users. Because the flaw needs only a valid authenticated session - not an admin role - every account that can reach the MCP configuration endpoint is a potential entry point. The fix landed in v0.8.2-rc2, which adds validation on the STDIO transport. The practical first step is knowing where LibreChat runs across your fleet and which version each instance is on, which requires an inventory of AI tooling on every endpoint." } }, { "@type": "Question", "name": "What does the vulnerability allow?", "acceptedAnswer": { "@type": "Answer", "text": "Any authenticated user can craft an API request targeting the MCP STDIO endpoint and have the supplied command and arguments interpreted directly as shell input. LibreChat performs no sanitization or allowlisting, so the command executes as root inside the container. That yields full container compromise and a foothold for lateral movement to whatever the container can reach - internal services, cloud metadata endpoints, and credentials mounted into the workload." } }, { "@type": "Question", "name": "How is CVE-2026-22252 related to other MCP STDIO flaws?", "acceptedAnswer": { "@type": "Answer", "text": "It is one of several independently reported instances of the same underlying pattern: an MCP STDIO transport that accepts a command and arguments and passes them to the system shell without validation. The same execution pattern was reported in MCP Inspector, WeKnora, and others. Treating it as a single-product bug misses the point - STDIO transports that take user-controlled commands are a recurring class, which is why a fleet-wide policy on MCP execution matters more than patching one application." } }, { "@type": "Question", "name": "How does Anomity help with CVE-2026-22252?", "acceptedAnswer": { "@type": "Answer", "text": "Anomity inventories AI tooling - including MCP servers and the applications that host them - across every managed endpoint and surfaces the version in use, so finding every vulnerable LibreChat instance is one query rather than a fleet hunt. On agents that expose a hook, it allows, denies, or logs each MCP tool call before it runs, so a STDIO command an injection attempt would trigger is evaluated against policy first. Every install, version change, and decision is recorded in a queryable 90-day audit trail." } } ] } ``` ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://anomity.ai/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://anomity.ai/blog/" }, { "@type": "ListItem", "position": 3, "name": "LibreChat MCP STDIO Command Injection to Root RCE - CVE-2026-22252", "item": "https://anomity.ai/blog/librechat-mcp-stdio-rce-cve-2026-22252/" } ] } ```