CVE-2026-12798: Litellm SSRF Vulnerability

CVE-2026-12798 Overview

CVE-2026-12798 is a Server-Side Request Forgery (SSRF) vulnerability in BerriAI litellm through version 1.82.2. The flaw resides in the load_openapi_spec_async function within litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py, part of the MCP OpenAPI Spec Loader component. An authenticated remote attacker can manipulate the spec_path argument to coerce the server into issuing arbitrary outbound HTTP requests. A public proof-of-concept exists, and the vendor was contacted prior to disclosure. The weakness is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
An attacker with low privileges can abuse the spec_path parameter to direct the litellm proxy at internal network resources, cloud metadata endpoints, or attacker-controlled URLs.

Affected Products

BerriAI litellm versions up to and including 1.82.2
litellm proxy deployments exposing the _experimental/mcp_server endpoints
Self-hosted MCP OpenAPI Spec Loader integrations using openapi_to_mcp_generator.py

Discovery Timeline

2026-06-21 - CVE-2026-12798 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-12798

Vulnerability Analysis

The vulnerability sits in the MCP (Model Context Protocol) OpenAPI Spec Loader of the litellm proxy. The function load_openapi_spec_async accepts a user-controlled spec_path value intended to point at an OpenAPI specification document. The implementation fetches the resource without enforcing an allow-list of hosts, URL schemes, or IP ranges. As a result, an attacker supplies a crafted URL and the litellm server issues the HTTP request on the attacker's behalf.

Because the proxy runs in environments that frequently hold cloud credentials and route traffic between AI models, the SSRF primitive can reach internal services that are not exposed to the public internet. This includes cloud instance metadata services, internal admin panels, and other services bound to loopback or private subnets.

Root Cause

The root cause is missing validation of the spec_path parameter before it is passed to the asynchronous HTTP client inside load_openapi_spec_async. The function trusts the caller to supply a safe URL and does not constrain protocol handlers, resolve and verify destination IPs, or block private address ranges defined in RFC 1918 and RFC 6890.

Attack Vector

Exploitation requires network access to the litellm proxy and low-privilege authenticated access to the MCP server endpoint that invokes load_openapi_spec_async. The attacker submits a request where spec_path references an internal URL such as http://169.254.169.254/latest/meta-data/ on AWS or an internal HTTP service on 127.0.0.1. The proxy executes the fetch and may return response data or behavioral side effects observable to the attacker. A public proof-of-concept is hosted as a GitHub Gist by YLChen-007, and the issue is tracked in VulDB entry 372560.

Detection Methods for CVE-2026-12798

Indicators of Compromise

Outbound HTTP requests from the litellm proxy host to cloud metadata IPs such as 169.254.169.254 or fd00:ec2::254.
Proxy access logs showing MCP OpenAPI loader calls with spec_path values pointing to private RFC 1918 ranges or localhost.
Unexpected DNS queries from the litellm host targeting attacker-controlled domains used as SSRF canaries.

Detection Strategies

Inspect litellm proxy logs for calls to openapi_to_mcp_generator.py and correlate spec_path values against an allow-list.
Deploy egress filtering at the network layer and alert on litellm-originated traffic to internal subnets or cloud metadata endpoints.
Monitor process and socket telemetry on hosts running litellm for outbound connections that deviate from the baseline of approved upstream model providers.

Monitoring Recommendations

Forward litellm application logs and host network telemetry to a centralized SIEM and tag MCP-related events for review.
Alert when the litellm service initiates connections to link-local, loopback, or private IP ranges.
Track authentication events on litellm proxy API keys to identify low-privilege accounts that begin exercising MCP OpenAPI loader functionality.

How to Mitigate CVE-2026-12798

Immediate Actions Required

Upgrade litellm to a release later than 1.82.2 once the maintainers publish a fix addressing CVE-2026-12798.
Restrict access to the _experimental/mcp_server endpoints to trusted administrators only.
Rotate any cloud credentials or API tokens accessible from the litellm host, since SSRF may have already exposed instance metadata.

Patch Information

At the time of publication, no vendor advisory URL is listed in NVD. Review the VulDB CVE-2026-12798 entry and the upstream BerriAI litellm repository for the latest release notes and commits addressing the load_openapi_spec_async function.

Workarounds

Disable the experimental MCP OpenAPI Spec Loader by removing or gating the litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py route in deployments that do not require it.
Enforce strict egress firewall rules on the litellm host to block traffic to 169.254.169.254, loopback, and RFC 1918 ranges except for explicitly required destinations.
Place the litellm proxy behind an authenticating reverse proxy and require elevated privileges before any MCP spec-loading endpoint is reachable.

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -m owner --uid-owner litellm -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner litellm -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner litellm -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner litellm -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner litellm -d 192.168.0.0/16 -j REJECT