EUVD-2026-38140
GHSA-h9c7-cfj6-h8j6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network SSRF requiring low-privilege auth (PR:L); scope changes as server contacts internal systems; limited C/I from internal probing, no meaningful availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function _execute_with_mcp_client of the file litellm/proxy/_experimental/mcp_server/rest_endpoints.py of the component MCP Server Connection Testing. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
AnalysisAI
Server-side request forgery in BerriAI LiteLLM versions up to 1.82.2 allows authenticated remote attackers to induce the proxy server to make arbitrary outbound HTTP requests by manipulating the MCP (Model Context Protocol) Server Connection Testing endpoint. The vulnerable function _execute_with_mcp_client in the experimental MCP server component fails to validate or restrict user-supplied connection targets, enabling internal network probing, potential access to cloud metadata services, and circumvention of network segmentation controls. A publicly available proof-of-concept exploit exists (GitHub gist by YLChen-007); no CISA KEV listing was present at time of analysis. The CVSS 4.0 reported score of 2.1 reflects threat-metric downgrade from E:P (proof-of-concept) and should not be taken as indicative of low inherent exploitability - the base network vector with low-privilege access represents a meaningful internal network exposure risk.
Technical ContextAI
LiteLLM is a Python-based LLM proxy gateway (vendor: BerriAI) used to unify multiple AI provider APIs behind a single endpoint. The affected component is an experimental MCP (Model Context Protocol) server integration within litellm/proxy/_experimental/mcp_server/rest_endpoints.py, specifically the _execute_with_mcp_client function, which is used to test connectivity to MCP-compatible tool servers. CWE-918 (Server-Side Request Forgery) describes the root cause: the application accepts a user-controlled URL or connection parameter and uses it to initiate an outbound network connection from the server without adequately validating the destination. This class of flaw is particularly dangerous in cloud-deployed AI gateway infrastructure where the server typically has access to internal APIs, cloud provider metadata endpoints (e.g., 169.254.169.254), and adjacent microservices not exposed to the public internet. The CPE string cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:* confirms the vulnerability applies broadly across the litellm package.
RemediationAI
No vendor-released patched version was independently confirmed at time of analysis - the affected version range tops out at 1.82.2 with no fix version cited in VulDB, EUVD, or NVD references. Organizations should monitor the BerriAI LiteLLM GitHub repository and official release notes for a patched release above 1.82.2. As an immediate compensating control, operators should disable or restrict access to the experimental MCP server endpoints in litellm/proxy/_experimental/mcp_server/rest_endpoints.py if MCP connection testing is not required; removing or commenting out the route registration for _execute_with_mcp_client eliminates the attack surface entirely at the cost of losing MCP connectivity testing functionality. If disabling is not feasible, restrict API access to the MCP testing endpoint via network ACLs or the LiteLLM proxy's built-in role-based access controls so that only highly trusted accounts can invoke it. Additionally, deploy an egress firewall rule blocking outbound connections from the LiteLLM proxy host to RFC-1918 ranges and cloud metadata IP addresses (e.g., 169.254.169.254, 100.64.0.0/10) to limit SSRF reach; this does not eliminate the vulnerability but meaningfully constrains exploitation impact. References: https://vuldb.com/vuln/372516, https://nvd.nist.gov/vuln/detail/CVE-2026-12774.
SQL injection in LiteLLM proxy server versions 1.81.16 through 1.83.6 allows unauthenticated remote attackers to read an
Authentication bypass in LiteLLM (BerriAI) proxy/AI Gateway before 1.84.0 lets a remote unauthenticated attacker reach M
Remote command execution in LiteLLM proxy server versions 1.74.2 through 1.83.6 allows any authenticated user to execute
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. Rated critical s
Remote code execution in BerriAI LiteLLM (all versions through 2026-04-08) enables authenticated attackers to execute ar
BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on t
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error oc
In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerabi
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. Rated high severity (CVSS
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` en
A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated
berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. Rated med
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today