The vulnerability resides in the _execute_with_mcp_client function in litellm’s MCP Server Connection Testing component. It allows an attacker to manipulate the request so that the server performs arbitrary outbound HTTP requests. This Server‑Side Request Forgery can expose internal network resources, retrieve sensitive data, or be used to pivot to further attacks. The weakness is identified as CWE‑918, reflecting improper validation of user‑controlled data used to construct web requests.

BerriAI:litellm versions up to and including 1.82.2 are susceptible. No versions above 1.82.2 are listed as affected. The vulnerability is confined to the rest_endpoints.py file within the MCP Server Connection Testing module.

The CVSS base score is 5.3, indicating a moderate impact. The EPSS score is not available, so the precise exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Remote exploitation is possible because the flaw is triggered by a standard HTTP request to the server. Publicly disclosed exploit code exists, so an attacker could readily deploy the attack against any exposed instance of the vulnerable package.