LiteLLM CVE-2026-30623

Exploitation requires the ability to create or modify an MCP server entry in LiteLLM using the JSON configuration that specifies command and args for a stdio-transport MCP server - that management/configuration capability is the exact prerequisite. This limits realistic exploitation to actors who can reach the MCP-server-creation feature: in most deployments that is an authenticated administrator or, in multi-tenant/self-service setups, any user granted MCP-configuration rights. The CVSS PR:N (unauthenticated) claim conflicts with the description's requirement to add a server configuration, so authentication requirements are not cleanly confirmed from the data - verify with the vendor whether MCP registration is exposed unauthenticated. No user interaction by a victim is needed once the attacker can submit the config, and successful command execution is bounded by the OS privileges of the LiteLLM process.

The signals conflict and must be weighed carefully. The published CVSS vector (AV:N/AC:L/PR:N/UI:N) scores this 9.8 as remote and unauthenticated, but the description makes clear that exploitation requires the ability to add/configure an MCP server - an administrative/authenticated management action in a typical LiteLLM proxy deployment - so PR:N is likely overstated; treat the true privilege requirement as at least low. EPSS is only 0.32% (24th percentile), it is NOT on CISA KEV, and no POC is confirmed in the input, which argues against imminent mass exploitation. However, the impact if reached is total (C:H/I:H/A:H → full host RCE), and this CVE is part of a coordinated multi-vendor MCP command-injection advisory, raising the chance of copycat tooling. Net: high-impact but access-gated - prioritize for any internet-exposed or multi-tenant LiteLLM instance where untrusted users can reach MCP configuration, and lower priority for locked-down single-operator deployments.

An attacker who reaches LiteLLM's MCP server-creation function - for example a lower-privileged tenant or an attacker who obtained proxy management access - submits a JSON MCP server definition whose command is a shell/interpreter and whose args carry a payload (e.g. a reverse shell or credential-dump command). When LiteLLM instantiates that stdio MCP server it executes the supplied command on the host, giving the attacker code execution with the privileges of the LiteLLM process. No public exploit is identified at time of analysis, but the low attack complexity means a working POC would be trivial to build from the described mechanism.