BerriAI LiteLLM CVE-2026-12798

Authentication is required: the CVSS 4.0 vector specifies PR:L (low privilege), meaning the attacker must have at least a valid low-privilege account or API key on the LiteLLM instance. The vulnerable function load_openapi_spec_async is located in the _experimental MCP server component, meaning this attack surface is only present when the experimental MCP OpenAPI spec loader feature is active - deployments that do not use this component are not exposed. The attacker must be able to supply or influence the spec_path argument to the vulnerable function. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated access is obtained, exploitation is straightforward. Exploitation is limited by: (1) the PR:L authentication requirement excluding fully unauthenticated attackers; (2) the experimental/non-default nature of the MCP component; and (3) the absence of scope change to subsequent systems per CVSS 4.0 SC:N, which bounds the SSRF impact to resources reachable from the LiteLLM host network.

The official CVSS 4.0 score is 2.1, which is very low, driven primarily by PR:L (low-privilege authentication required) and uniformly low impact metrics (VC:L/VI:L/VA:L with no subsequent-system impact: SC:N/SI:N/SA:N). The E:P modifier confirms a proof-of-concept exists, which elevates practical exploitability above theoretical. No CISA KEV listing means active in-the-wild exploitation is not confirmed. The vulnerability resides in an explicitly experimental component (_experimental directory), which may reduce its attack surface in production deployments where this feature is not enabled or exposed. Taken together, this is a real but low-priority vulnerability: the authentication barrier (PR:L) meaningfully limits the attacker pool, and the SSRF impact is bounded by the server's network position and the absence of confirmed scope change to subsequent systems. However, in cloud-hosted LiteLLM deployments with access to metadata endpoints, even a low-privilege SSRF can escalate to credential theft - defenders should evaluate their specific hosting environment. CVSS 4.0 score and SSRF nature are consistent; no conflicts detected between vector and description.

An authenticated attacker with low-privilege API access to a LiteLLM instance submits a crafted request to the MCP OpenAPI Spec Loader, supplying a spec_path value pointing to an internal cloud metadata endpoint such as http://169.254.169.254/latest/meta-data/iam/security-credentials/. The LiteLLM server fetches the URL and the response - potentially containing IAM credentials - is returned to or observable by the attacker. A public proof-of-concept is available at https://gist.github.com/YLChen-007/c1104c529975699ba347feedfbe02c5a, confirming the attack is straightforward to reproduce.