Loading the catalogue…
Chat UIs · LibreChat (acquired by ClickHouse Inc.) · US
LibreChat
US CLOUD Act exposureOpen sourceMIT
STAV REVIEW · LAST REVIEWED 06/21/2026
“Genuinely Sovereign when self-hosted, but 13 CVEs in 90 days — including a CVSS 9.9 MCP stdio RCE — demand strict patch discipline before any production deployment.”
Good for
- Teams wanting a provider-agnostic AI chat interface that keeps all conversation data on their own infrastructure
- Organisations needing enterprise SSO out of the box — OAuth2, OIDC, SAML, LDAP, and two-factor auth are all supported
- Deployments that must route Inference across a mix of providers (OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Vertex) from a single installation
- Air-gapped or on-premises environments where Docker or Kubernetes is already the standard deployment target
Watch out for
- 29 total GHSA advisories, with 13 published in the trailing 90 days; the MCP attack surface produced a CVSS 9.9 RCE (CVE-2026-22252) and a CVSS 9.1 SSRF (CVE-2025-69222) — both patched in v0.8.6, but patch cadence must track the ~7-day release cycle or exposure windows open fast
- No SBOM, signed binaries, bug-bounty programme, or security.txt confirmed — supply-chain assurance is entirely on the operator
- Parent company ClickHouse, Inc. is US-incorporated (Delaware), creating confirmed CLOUD Act exposure at the corporate level; self-hosted architecture removes the data path to vendor infrastructure but does not eliminate legal jurisdiction risk — regulated teams need a formal legal assessment
- No SOC 2, ISO 27001, DPA, or SLA has been confirmed for LibreChat; it does not qualify as Sovereign under Stav's definition
Editorial assessment, not legal advice. Stav's risk ratings, scores, and verdicts are our own analysis of publicly available information and may be incomplete or out of date. Verify independently before making compliance or procurement decisions.
MODEL REQUIREMENTS
What LibreChat needs from a model.
Required
- Streaming
Recommended
- Long context (≥128k)
- Tool calling
- Vision input
Known issues8 open
Public security, privacy and governance advisories that are still open. Each row carries a source link — these are factual claims, not editorial judgements.
2026-06-30
lowUpstream change on librechat: github_last_push '2026-06-23T02:49:58Z' → '2026-06-30T02:54:43Z'
other · open
Source ↗2026-06-23
lowUpstream change on librechat: github_last_push '2026-06-16T03:13:05Z' → '2026-06-23T02:49:58Z'
other · open
Source ↗2026-06-16
lowUpstream change on librechat: github_last_push '2026-06-09T03:47:07Z' → '2026-06-16T03:13:05Z'
other · open
Source ↗2026-06-09
lowUpstream change on librechat: github_last_push '2026-06-02T05:17:55Z' → '2026-06-09T03:47:07Z', cve_count 16 → 29
other · open
Source ↗2026-06-02
lowUpstream change on librechat: github_last_push '2026-05-19T01:40:17Z' → '2026-06-02T05:17:55Z'
other · open
Source ↗