Executive brief
LiteLLM is a tool used to manage and connect various AI models through a single interface. A security flaw in its Model Context Protocol (MCP) server testing component allows an attacker with a valid API key to force the server to send unauthorized requests to internal or external network locations. This could be used to scan internal company networks, bypass firewalls, or leak sensitive credentials to an attacker-controlled server.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in LiteLLM up to version 1.82.2 within the `_execute_with_mcp_client` function of `litellm/proxy/_experimental/mcp_server/rest_endpoints.py`. The vulnerability is triggered via the `/v1/mcp/test/connection` management endpoint. When a user provides `client_id`, `client_secret`, and a `token_url` in the request payload, the application automatically initiates an OAuth2 client credentials flow. Because the `token_url` is not validated or restricted to a whitelist, an authenticated attacker can force the proxy to send HTTP POST requests to arbitrary internal or external IP addresses. This can be leveraged for internal network reconnaissance or to leak the provided `client_secret` to a malicious listener.
Affected products
- BerriAI litellm <= 1.82.2
Timeline
- 2026-03-21: disclosed: Initial public disclosure via GitHub Gist
- 2026-06-21: advisory: NVD and VulDB publication