Is there a public PoC exploit available for CVE-2026-12773?

Yes, a public proof-of-concept exploit is available for CVE-2026-12773. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-12773?

Yes, a patch is available for CVE-2026-12773. Update the affected software to the latest version immediately.

LiteLLM CVE-2026-12773

Q: What is the CVSS score of CVE-2026-12773?

CVE-2026-12773 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38139 MEDIUM

Improper Authentication (CWE-287)

2026-06-21 VulDB

GHSA-4jcj-7x88-m979

Authentication Bypass Litellm Berriai

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible auth bypass requiring no privileges or interaction; S:U and uniform Low impact reflect constrained MCP proxy access without scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Red Hat

7.3 HIGH

qualitative

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:29 vuln.today

CVSS changed

Jun 21, 2026 - 04:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

14 pypi packages depend on litellm (12 direct, 2 indirect)

Ecosystem-wide dependent count for version 1.84.0.

DescriptionCVE.org

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

AnalysisAI

Authentication bypass in BerriAI LiteLLM versions 1.59.0 through 1.59.8 allows unauthenticated remote attackers to circumvent the UserAPIKeyAuth function within the experimental MCP Proxy server component, gaining unauthorized access to protected LLM proxy functionality without valid credentials. A public proof-of-concept exploit is confirmed available via GitHub gist (YLChen-007), materially lowering the bar for exploitation. No CISA KEV listing is present at time of analysis, but the network-accessible, zero-authentication attack surface combined with an available PoC warrants urgent remediation prioritization for any deployment with the MCP server component exposed.

Technical ContextAI

LiteLLM (by BerriAI, CPE: cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*) is an open-source AI proxy and gateway that provides unified API access to multiple large language model providers. The vulnerability resides in an experimental extension: the MCP (Model Context Protocol) Proxy server, located under the _experimental path at litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py. The specific function UserAPIKeyAuth is responsible for authenticating inbound requests using API keys before permitting access to the proxy. CWE-287 (Improper Authentication) indicates the root cause is a failure to correctly verify the identity or credentials of the caller - likely a logic flaw, missing validation step, or bypassable check within the key authentication routine. Because this component is in an experimental subdirectory, it may receive less rigorous security review than the core proxy codebase, and its enablement status in default configurations is not confirmed by the available references.

RemediationAI

No vendor-released patch version has been independently confirmed from the available references at time of analysis; fix status should be verified directly against the BerriAI LiteLLM upstream repository and the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-12773. As an immediate compensating control, determine whether the experimental MCP server is active in your deployment by checking for the presence and activation of litellm/proxy/_experimental/mcp_server/ - if this feature is not in active use, disabling it eliminates the attack surface with minimal operational impact given its experimental status. If the MCP server must remain enabled, restrict network access to the LiteLLM proxy port using host-based or network firewall rules, limiting inbound connections to known trusted client IPs only; this introduces operational friction for dynamic client environments. Additionally, deploy authentication enforcement at the reverse proxy or load balancer layer (e.g., requiring a valid bearer token before traffic reaches LiteLLM) as a defense-in-depth measure. Rotate any backend LLM provider API keys configured in LiteLLM if the MCP endpoint was exposed to untrusted networks.