EUVD-2026-44846
GHSA-gw7c-8jfv-4mj2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and low-complexity, but adding an MCP server config is a management action requiring authenticated access, so PR:L rather than PR:N; impact is full host RCE (C/I/A:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.
AnalysisAI
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitrary command and args values in the server-creation JSON, which LiteLLM passes to the host OS without validation, yielding remote code execution as the LiteLLM process. The flaw is part of the broader MCP-stdio supply-chain advisory disclosed by ox.security across the AI ecosystem and is documented in LiteLLM's own April 2026 advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to create or modify an MCP server entry in LiteLLM using the JSON configuration that specifies `command` and `args` for a stdio-transport MCP server - that management/configuration capability is the exact prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and must be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who reaches LiteLLM's MCP server-creation function - for example a lower-privileged tenant or an attacker who obtained proxy management access - submits a JSON MCP server definition whose `command` is a shell/interpreter and whose `args` carry a payload (e.g. a reverse shell or credential-dump command). … |
| Remediation | No vendor-released fixed version is identified in the provided data, so upgrade to the latest LiteLLM release after confirming the fix in the vendor advisory (https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026) and the GitHub repository, and do not run 1.18.10 in exposed environments. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all LiteLLM 1.18.10 deployments with MCP server integration enabled, disable MCP functionality if not operationally required, and audit who has administrative access to MCP configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today