CVE-2026-30623
Description
A flaw was found in LiteLLM. This vulnerability allows a remote attacker to execute arbitrary operating system commands on the host where LiteLLM is running. This is possible because the application's MCP server creation functionality processes JSON configurations that can include unvalidated command and argument values. Successful exploitation could lead to a complete compromise of the affected system.
Statement
This flaw allows an attacker who already possesses a valid LiteLLM Proxy API key to execute arbitrary operating system commands on the host running LiteLLM, via its MCP server creation and management functionality (NewMCPServerRequest/UpdateMCPServerRequest, and the /mcp-rest/test/* preview endpoints), which pass a user-supplied 'command' value to a subprocess without validation. Per the upstream advisory, exploitation requires authentication -- it is not reachable by a fully unauthenticated attacker -- but no further privilege beyond a working API key is needed to reach the vulnerable code path. Successful exploitation can result in complete compromise of the host running the LiteLLM process.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 9.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Corrected PR from N to L: LiteLLM's own security advisory (docs.litellm.ai/blog/mcp-stdio-command-injection-april-2026) states exploitation requires a valid LiteLLM Proxy API key ('This was not exploitable by unauthenticated users... An attacker needed a valid LiteLLM API key'). The original PR:N vector contradicted this; see internal flaw comment for full rationale.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
