What is the CVSS score of CVE-2026-30623?

CVE-2026-30623 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of LiteLLM are affected by CVE-2026-30623?

LiteLLM 1.18.10 contains a critical remote code execution vulnerability in its MCP (Model Context Protocol) server integration that allows arbitrary command execution within the LiteLLM process…

Is there a public PoC exploit available for CVE-2026-30623?

Yes, a public proof-of-concept exploit is available for CVE-2026-30623. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-30623?

Within 24 hours, inventory all LiteLLM 1.18.10 deployments with MCP server integration enabled, disable MCP functionality if not operationally required, and audit who has administrative access to MCP configurations. Within 7 days, implement network segmentation to isolate LiteLLM processes from other systems, run LiteLLM under a dedicated service account with minimal OS privileges, and enforce mandatory code review for all MCP server configuration changes. Within 30 days, establish ongoing monitoring of LiteLLM and MCP configurations with alerting on unauthorized changes, maintain detailed audit trails of all MCP-related administrative actions, and actively monitor vendor security advisories for future patch releases.

LiteLLM CVE-2026-30623

EUVD-2026-44846 CRITICAL

Command Injection (CWE-77)

2026-07-15 mitre

GHSA-gw7c-8jfv-4mj2

RCE Command Injection N A Red Hat

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable and low-complexity, but adding an MCP server config is a management action requiring authenticated access, so PR:L rather than PR:N; impact is full host RCE (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

8.8 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 14:23 vuln.today

CVSS changed

Jul 16, 2026 - 14:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 15, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jul 15, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.

AnalysisAI

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitrary command and args values in the server-creation JSON, which LiteLLM passes to the host OS without validation, yielding remote code execution as the LiteLLM process. The flaw is part of the broader MCP-stdio supply-chain advisory disclosed by ox.security across the AI ecosystem and is documented in LiteLLM's own April 2026 advisory. No public exploit is identified in the provided data, and EPSS is low (0.32%, 24th percentile), so widespread automated exploitation is not currently indicated despite the CVSS 9.8 rating.

Technical ContextAI

LiteLLM is an open-source LLM gateway/proxy that unifies access to many model providers and supports the Model Context Protocol (MCP) for tool integration. The vulnerable feature lets an operator register an MCP server of the stdio transport type, where LiteLLM spawns a local child process defined by a user-supplied command and args array. Because those values are taken directly from the JSON configuration and executed on the host without sanitization or allow-listing, this is a classic CWE-77 (Improper Neutralization of Special Elements used in a Command) command-injection primitive: the MCP stdio launch path effectively becomes an arbitrary process-execution API. The provided CPE string (cpe:2.3:a:n/a:n/a) is a placeholder with no meaningful product/vendor data, so exact affected-product identification relies on the description naming version 1.18.10.

RemediationAI

No vendor-released fixed version is identified in the provided data, so upgrade to the latest LiteLLM release after confirming the fix in the vendor advisory (https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026) and the GitHub repository, and do not run 1.18.10 in exposed environments. As specific compensating controls until a confirmed patch is applied: restrict who can create or edit MCP server configurations to trusted administrators only (removing this capability from general/API users eliminates the primary attack surface but disables self-service MCP onboarding); disable the stdio MCP transport or block registration of MCP servers with arbitrary command/args if your deployment does not require locally-spawned tools (trade-off: local stdio-based MCP tools stop working); run the LiteLLM process as a low-privilege, sandboxed/containerized user with no host shell access and a minimal filesystem so that any injected command has limited blast radius; and place the proxy behind authentication and network ACLs so the management/config endpoints are not reachable by untrusted clients.