LiteLLM CVE-2026-12774

Exploitation requires the attacker to hold a valid authenticated session or API key with at least low-privilege access to the LiteLLM proxy instance (PR:L per CVSS 4.0 vector). The vulnerable endpoint is within an explicitly experimental component (_experimental/mcp_server), meaning deployments that have not enabled or exposed the MCP server proxy feature may not present this attack surface - however, because the code resides in the package and may be initialized by default in some configurations, operators cannot assume safety without confirming the endpoint is unreachable. No user interaction is required and attack complexity is low (AC:L/AT:N), meaning exploitation is straightforward once credentials are obtained. The primary limiting factors are: (1) the requirement for authenticated API access, reducing the exposed population to users or automated systems with valid credentials, and (2) the experimental/opt-in nature of the MCP component, which may not be active in all deployments. SSRF impact is further bounded by the network egress policy of the host running the proxy.

Real-world risk is moderate-to-significant despite the reported CVSS 4.0 score of 2.1, which is depressed by the E:P threat metric (proof-of-concept maturity) and low individual CIA impact ratings. The base network vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates no special attack complexity beyond valid credentials, which is a meaningful threat in environments where LiteLLM is deployed as a shared internal proxy and multiple users or service accounts have API access. SSRF vulnerabilities in AI gateway products are high-value because these servers frequently run with cloud IAM roles, sit inside private network segments, and have connectivity to internal model registries or admin APIs. The EPSS score was not provided - this is a data gap. No CISA KEV listing exists, indicating exploitation has not been confirmed as widespread, but the public PoC lowers the barrier to exploitation. The CVSS 4.0 SC:N rating (no subsequent-system impact) may understate realistic risk: SSRF by definition causes the vulnerable server to interact with other systems, and the N rating likely reflects the conservative NVD/VulDB assessment rather than a definitive architectural constraint. Defenders should treat this as a meaningful lateral-movement enabler in cloud-hosted deployments.

An attacker with a valid low-privilege API key for a shared LiteLLM proxy deployment sends a crafted POST request to the MCP server connection testing endpoint, supplying an internal URL such as http://169.254.169.254/latest/meta-data/ or an internal admin API address as the MCP server target. The LiteLLM proxy issues an HTTP request to the attacker-specified destination and may return or log the response, allowing the attacker to enumerate cloud instance metadata, harvest IAM credentials, or map internal services. A public PoC is available at https://gist.github.com/YLChen-007/256c8ff0750e298f89b6b287c90c2981, confirming this attack path is documented and reproducible.