MediumVulnerability
CVE-2026-54037: LibreChat rate limit bypass via unlimited POST /api/convos/duplicate requests
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-54037
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
LibreChat versions prior to 0.8.4-rc1 had a rate-limiting gap. The fix for CVE-2025-7105 added forkIpLimiter and forkUserLimiter to POST /api/convos/fork, but the POST /api/convos/duplicate endpoint in the same file, which runs the same expensive database operations, received no limiter. An authenticated user can exhaust server resources by calling /duplicate instead of /fork.
Mitigation
Fixed in 0.8.4-rc1.
Related items
- HighCVE-2026-123356: GROBID unauthenticated thread exhaustion through /api/modelTraining endpointSimilar attack · NVD/CVE Database
- MediumCVE-2026-83494: training-operator immutability check bypass in PyTorchJob ValidateUpdate webhookSimilar attack · NVD/CVE Database
- CriticalCVE-2026-48705: MONAI PydicomReader affine computation accepts non-finite DICOM valuesSimilar attack · NVD/CVE Database
- LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence