Executive brief
LiteLLM, a tool used to manage and connect various AI models, contains a security flaw in how it handles Model Context Protocol (MCP) servers. An authorized user could provide a specially crafted configuration that forces the server to execute unauthorized operating system commands. This could allow an attacker to take full control of the LiteLLM process, potentially leading to data theft or service disruption.
Technical details
LiteLLM versions prior to 1.83.7-stable are vulnerable to command injection within the MCP server creation functionality. The vulnerability exists because the application accepts JSON configurations for MCP servers using the 'stdio' transport and passes the 'command' and 'args' fields directly to a subprocess launcher without validation. An authenticated attacker with permissions to create MCP servers or access preview endpoints (such as /mcp-rest/test/connection) can execute arbitrary shell commands with the privileges of the LiteLLM process. The fix introduces a command allowlist (e.g., npx, uvx, python) and restricts access to the preview endpoints to users with the PROXY_ADMIN role.
Affected products
- BerriAI LiteLLM < 1.83.7-stable
Timeline
- 2026-04-15: disclosed: Initial advisory by OX Security regarding MCP SDK vulnerabilities
- 2026-04-21: patched: LiteLLM released fix in v1.83.6-nightly and v1.83.7-stable
- 2026-07-15: advisory: CVE-2026-30623 published to NVD