CVE-2026-30623

litellm: LiteLLM: Remote code execution via unvalidated MCP server configuration

Published Jul 15, 2026 CVSS 3.1 · 9.8 Critical EPSS 6.0% KEV · Not listed

Description

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.

Analysis

Technical impact

LiteLLM version 1.18.10 contains a flaw in its MCP server creation routine that accepts arbitrary command and argument values from a JSON configuration. The application executes these values on the host without any validation, allowing an attacker to run any operating system command with the privileges of the LiteLLM process. This results in full remote code execution, giving the attacker control over the underlying host.

Affected Systems

The vulnerability affects LiteLLM, automatically adding MCP servers via JSON configuration. Only the 1.18.10 release is documented as vulnerable; earlier releases are not known to contain this issue.

Risk and Exploitability

The CVSS score of 9.8 indicates critical severity. The EPSS score is 6%, suggesting that, while exploitation is not common, it is technically possible and could be achieved if an attacker gains access to the configuration interface. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been reported, but the nature of the flaw allows arbitrary command execution with no additional preconditions beyond the ability to submit a JSON configuration to LiteLLM.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

Vendor Product Versions

Berriai

Litellm

Version	Status	Scheme	Platform
`1.18.10`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade LiteLLM to a version in which the MCP command parameters are validated or the ability to inject commands is removed.
Limit the exposure of the configuration interface so that only trusted, authenticated users can add MCP servers, and apply strict network access controls.
Implement logging and monitoring of process execution to detect unexpected command invocation by LiteLLM.
Consider removing the ability to add MCP servers from untrusted environments as a temporary protective measure.

Generated by OpenCVE AI on August 4, 2026 at 18:33 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 6.0% (5.952% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026
https://github.com/BerriAI/litellm
https://nvd.nist.gov/vuln/detail/CVE-2026-30623
https://www.cve.org/CVERecord?id=CVE-2026-30623
https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/

History

Jul 17, 2026 12:15 AM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		litellm: LiteLLM: Remote code execution via unvalidated MCP server configuration
Weaknesses		CWE-78
References		https://nvd.nist.gov/vuln/detail/CVE-2026-30623 https://www.cve.org/CVERecord?id=CVE-2026-30623
Metrics	threat_severity `None`	threat_severity `Critical`

Jul 16, 2026 2:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-77
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 15, 2026 11:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Berriai Berriai litellm
Vendors & Products		Berriai Berriai litellm

Jul 15, 2026 9:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.
References		https://docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026 https://github.com/BerriAI/litellm https://www.ox.security/blog/mcp-supply-chain-advisory-rce-vulnerabilities-across-the-ai-ecosystem/

Subscriptions

Berriai Litellm

Weaknesses

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')