Is CVE-2026-12773 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12773 being exploited in the wild.

How severe is CVE-2026-12773?

High severity, with a CVSS score of 7.3, published 21 June 2026.

Which products and versions are affected?

Berriai LiteLLM < 1.84.0, <= 1.59.8; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.84.0.

Is there a fix for CVE-2026-12773?

Yes. litellm (PyPI): upgrade to 1.84.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12773 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12773?

Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12773: BerriAI LiteLLM authentication bypass in MCP Proxy

Q: Which products and versions are affected?

Berriai LiteLLM < 1.84.0, <= 1.59.8; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.84.0.

Q: Is there a fix for CVE-2026-12773?

Yes. litellm (PyPI): upgrade to 1.84.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-12773 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-12773?

Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12773 · Severity: high · CVSS 7.3 · Published 2026-06-21

LiteLLM is a popular library for managing interactions with large language models and API proxies. The MCP (Model Context Protocol) Proxy component has a flaw in its authentication mechanism that allows attackers to bypass security checks by providing any arbitrary token, gaining unauthorized access to backend MCP servers. An attacker can leverage this to execute sensitive tools, extract data, or potentially achieve remote code execution without valid credentials.

Technologies: Berriai LiteLLM, litellm (PyPI). Vendors: Berriai, PyPI.

Quick answers

Is CVE-2026-12773 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12773 being exploited in the wild.
How severe is CVE-2026-12773?: High severity, with a CVSS score of 7.3, published 21 June 2026.
Which products and versions are affected?: Berriai LiteLLM < 1.84.0, <= 1.59.8; litellm (PyPI) ECOSYSTEM:introduced=0,fixed=1.84.0.
Is there a fix for CVE-2026-12773?: Yes. litellm (PyPI): upgrade to 1.84.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12773 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12773?: Check whether you run Berriai LiteLLM or litellm (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

litellm (PyPI): upgrade to 1.84.0 or later
```
pip install "litellm>=1.84.0"
```

Technical details

The vulnerability is a classic exception-swallowing authentication bypass in the process_mcp_request method. When the user_api_key_auth validation function raises a 401 or 403 HTTPException due to invalid or missing credentials, the code catches and discards the exception, then instantiates a default UserAPIKeyAuth() object that permits access. The flaw lies in litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py and affects the authorization flow in get_allowed_mcp_servers. Attack vector is network-based with no authentication or user interaction required. An attacker simply sends a JSON-RPC request with any arbitrary Bearer token to the MCP endpoint (e.g., POST /mock_server/mcp) and gains full access to configured MCP servers with allow_all_keys: true, enabling tool enumeration, data extraction, or RCE depending on available tools. The issue was patched in version 1.84.0.

Affected products

BerriAI LiteLLM < 1.84.0

Identifiers

CVE-2026-12773
GHSA-4jcj-7x88-m979
PYSEC-2026-4067

Timeline

2026-06-21: disclosed
2026-06-21: patched: Fixed in version 1.84.0
2026-09-10: advisory: GitHub Security Advisory reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.