CVE-2026-12774 Overview
CVE-2026-12774 is a Server-Side Request Forgery (SSRF) vulnerability affecting BerriAI litellm versions up to and including 1.82.2. The flaw resides in the _execute_with_mcp_client function within litellm/proxy/_experimental/mcp_server/rest_endpoints.py, part of the MCP Server Connection Testing component. An authenticated remote attacker can manipulate request parameters to force the litellm proxy to issue HTTP requests to attacker-chosen destinations. The exploit has been disclosed publicly. The vendor was contacted prior to disclosure. This issue is tracked under [CWE-918] and carries a CVSS 4.0 base score of 2.1 (LOW).
Critical Impact
Authenticated attackers can coerce the litellm proxy into sending requests to internal services, enabling reconnaissance of internal networks, cloud metadata endpoints, and otherwise unreachable APIs.
Affected Products
- BerriAI litellm versions up to 1.82.2
- litellm/proxy/_experimental/mcp_server/rest_endpoints.py MCP Server Connection Testing component
- Deployments exposing the litellm proxy MCP endpoints to authenticated users
Discovery Timeline
- 2026-06-21 - CVE-2026-12774 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-12774
Vulnerability Analysis
The vulnerability exists in the MCP (Model Context Protocol) Server Connection Testing logic of the litellm proxy. The _execute_with_mcp_client function accepts a user-supplied target endpoint and initiates an outbound connection without sufficient validation of the destination. Because the proxy performs the request server-side, attackers can use it as a relay to reach hosts and ports otherwise unreachable from their network position. The EPSS score is 0.262%, reflecting limited observed exploitation activity at the time of publication. A public proof-of-concept is available through a GitHub Gist PoC.
Root Cause
The root cause is missing validation of the URL or host parameter passed to the MCP client connection routine. The function constructs and dispatches an HTTP request using attacker-controlled input without enforcing an allowlist, blocking private address ranges, or restricting protocol handlers. This is a textbook [CWE-918] Server-Side Request Forgery pattern.
Attack Vector
Exploitation requires network access to the litellm proxy and low-privilege authentication. An attacker submits a crafted request to the MCP server connection testing endpoint, specifying an internal URL such as a metadata service (169.254.169.254), an internal admin panel, or a loopback service. The litellm process performs the request on the attacker's behalf and may return response data, headers, or timing information that discloses internal infrastructure. Refer to the VulDB CVE-2026-12774 entry for additional technical context.
Detection Methods for CVE-2026-12774
Indicators of Compromise
- Outbound HTTP requests from the litellm proxy host to private RFC1918 ranges, loopback, or link-local addresses (169.254.169.254).
- Requests to the MCP server connection testing endpoint containing URLs that do not match expected MCP server hostnames.
- Unusual proxy-originated traffic to cloud metadata services or internal management interfaces.
Detection Strategies
- Inspect litellm proxy access logs for calls to MCP test endpoints with non-allowlisted destination parameters.
- Correlate process-level network telemetry from the litellm host against an allowlist of legitimate MCP server endpoints.
- Alert on any DNS resolution from the litellm service for internal-only hostnames or metadata FQDNs.
Monitoring Recommendations
- Forward litellm application logs and host network telemetry to a centralized analytics platform for retention and correlation.
- Baseline normal outbound destinations from the litellm proxy and alert on deviations.
- Monitor authenticated API usage patterns and flag low-privilege accounts probing MCP testing functionality.
How to Mitigate CVE-2026-12774
Immediate Actions Required
- Upgrade BerriAI litellm to a version later than 1.82.2 once a fixed release is available from the maintainers.
- Restrict network egress from the litellm proxy host to only the destinations required for legitimate MCP server connections.
- Block the litellm host from reaching cloud metadata endpoints, loopback, and RFC1918 ranges at the network layer.
- Audit accounts with access to the MCP server connection testing endpoint and revoke unnecessary privileges.
Patch Information
No fixed version is referenced in the available advisory data. Monitor the VulDB CVE-2026-12774 record and the BerriAI litellm project release notes for a remediated build. Until a patch is published, apply compensating controls described below.
Workarounds
- Place the litellm proxy behind an egress firewall or forward proxy that enforces a destination allowlist for outbound HTTP.
- Disable or remove the experimental MCP server connection testing endpoint if it is not required for production workloads.
- Require elevated authentication or administrative role for any MCP connection testing operations.
- Deny resolution of internal hostnames and metadata service IPs at the DNS layer for the litellm service account.
# Example iptables egress restriction for the litellm proxy host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
