Is there a public PoC exploit available for CVE-2026-12798?

Yes, a public proof-of-concept exploit is available for CVE-2026-12798. Prioritise patching immediately. EPSS: 0.2%.

BerriAI LiteLLM CVE-2026-12798

Q: What is the CVSS score of CVE-2026-12798?

CVE-2026-12798 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38157 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-21 VulDB

GHSA-c693-x898-5g4h

SSRF Litellm Berriai

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.0 MEDIUM

SSRF yields scope change (S:C) as the server reaches internal resources; PR:L reflects required authentication; C:L for potential internal data disclosure; no integrity or availability impact confirmed.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:33 vuln.today

Severity Changed

Jun 21, 2026 - 10:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 10:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

6 pypi packages depend on litellm (6 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.82.2.

DescriptionCVE.org

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

AnalysisAI

Server-side request forgery in LiteLLM's experimental MCP OpenAPI Spec Loader allows authenticated remote attackers to coerce the server into issuing arbitrary HTTP requests by supplying a malicious spec_path value to the load_openapi_spec_async function. Affected versions are LiteLLM 1.82.0 through 1.82.2 as confirmed by EUVD. A public proof-of-concept exploit exists on GitHub, though the vulnerability is not in CISA KEV and the CVSS 4.0 score of 2.1 with E:P modifier reflects low-severity, authenticated exploitation with a known but apparently limited threat footprint.

Technical ContextAI

LiteLLM (cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*) is an open-source LLM proxy and gateway framework by BerriAI. The vulnerable code resides in litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py, within the load_openapi_spec_async function, which is part of an experimental Model Context Protocol (MCP) feature for converting OpenAPI specifications into MCP tool definitions. The function accepts a spec_path argument - intended to point to a local or remote OpenAPI spec - without sufficiently validating or restricting the target URL or path. This is classified as CWE-918 (Server-Side Request Forgery), where the server is weaponized into fetching attacker-controlled network resources, potentially exposing internal services, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), or other non-public infrastructure that the LiteLLM host can reach.

RemediationAI

No vendor-released patched version has been identified at time of analysis; the vendor was contacted early per the disclosure statement, but no fix version appears in the available references. Upstream fix availability should be confirmed by monitoring the BerriAI LiteLLM GitHub repository and VulDB advisory at https://vuldb.com/vuln/372560. As an immediate compensating control, operators should disable or restrict access to the experimental MCP server component if it is not required - this eliminates the vulnerable attack surface entirely, with no functional trade-off for deployments not using MCP OpenAPI spec generation. If the feature must remain active, restrict who can invoke load_openapi_spec_async to highly trusted users only, and implement outbound HTTP egress filtering on the LiteLLM host to block requests to internal RFC-1918 addresses and cloud metadata endpoints (e.g., 169.254.169.254). Egress filtering may cause spec-loading failures for legitimate internal OpenAPI specs and should be scoped accordingly. The public POC is available at https://gist.github.com/YLChen-007/c1104c529975699ba347feedfbe02c5a and can be used to validate remediation effectiveness in a controlled environment.