LiteLLM CVE-2026-12773

The experimental MCP server component (litellm/proxy/_experimental/mcp_server/) must be enabled and the proxy endpoint must be reachable over the network from the attacker. The flaw is specifically in the UserAPIKeyAuth function within the MCP authentication path, so only requests routed through the MCP server's auth layer are exploitable - standard LiteLLM proxy endpoints not using this component are not directly affected by this specific flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) states no attack requirements and no privileges needed, meaning no special configuration beyond the MCP server being active and reachable is required. The primary limiting factor is whether the experimental MCP server is deployed: the _experimental path prefix strongly suggests this feature may require explicit activation and is likely not enabled in default LiteLLM installations - defenders should audit their deployment configuration to confirm exposure. No authentication, user interaction, or platform-specific condition is indicated beyond the MCP server being active.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) positions this as a network-exploitable, unauthenticated, low-complexity flaw requiring no user interaction and no attack prerequisites - the most dangerous combination from an accessibility standpoint. However, impact is rated Low across all three dimensions (confidentiality, integrity, availability), capping the base score at 5.5. The E:P supplemental metric confirms the PoC availability. No CISA KEV listing is present, indicating no confirmed widespread active exploitation at time of analysis. The practical risk is amplified beyond the moderate CVSS score for organizations using LiteLLM as a gateway to commercial LLM providers: a successful bypass could expose backend provider API keys, enable unauthorized LLM usage billed to the victim, or allow manipulation of model routing. The experimental nature of the MCP server component is a critical unknown - if it requires explicit enablement, real-world exposure may be significantly lower than PR:N/AT:N implies. Defenders should treat the CVSS vector as a worst-case for exposed instances until default configuration is confirmed.

An attacker identifies a LiteLLM instance with the experimental MCP Proxy server enabled and network-accessible, then uses the publicly available proof-of-concept exploit (GitHub gist by YLChen-007) to send a crafted request that bypasses the UserAPIKeyAuth validation function without supplying valid credentials. Upon successful bypass, the attacker gains proxy-level access and can issue LLM API calls billed to the victim's configured provider accounts, enumerate or extract backend API keys stored in the LiteLLM configuration, or manipulate model routing to exfiltrate sensitive prompt data.