CVE-2026-30623: LiteLLM MCP Server RCE Vulnerability

CVE-2026-30623 Overview

CVE-2026-30623 is a command injection vulnerability in LiteLLM 1.18.10 that enables remote code execution. The flaw exists in the Model Context Protocol (MCP) server creation functionality. LiteLLM accepts a JSON configuration where users specify arbitrary command and args values when registering a new MCP server. The application passes these values to the host operating system without validation or sanitization. An attacker who can reach the MCP server creation endpoint can execute arbitrary operating system commands with the privileges of the LiteLLM process. The issue is tracked under [CWE-77] (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Unauthenticated network-based command injection leading to remote code execution on hosts running LiteLLM 1.18.10.

Affected Products

LiteLLM 1.18.10
LiteLLM MCP server creation feature (stdio transport)
BerriAI LiteLLM deployments exposing the MCP configuration endpoint

Discovery Timeline

2026-07-15 - CVE-2026-30623 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-30623

Vulnerability Analysis

LiteLLM is an open-source proxy and SDK that provides a unified interface to large language model providers. Version 1.18.10 introduced support for registering MCP servers through a JSON payload. The payload defines the transport type, the executable command, and an args array. LiteLLM spawns a subprocess using these attacker-controlled values to communicate with the MCP server over stdio. Because the application does not restrict which binaries can be invoked or validate arguments, any string supplied as command executes on the host. The vulnerability aligns with the broader MCP supply chain risk pattern documented by third-party researchers covering multiple AI ecosystem tools.

Root Cause

The root cause is missing input validation on the MCP server configuration. LiteLLM treats the command and args fields as trusted operator input and forwards them directly to a subprocess spawn call. No allowlist, sandbox, or shell-metacharacter filter is applied. Any user who can submit an MCP server definition can therefore choose arbitrary operating system executables.

Attack Vector

An attacker submits a crafted JSON MCP server configuration to a reachable LiteLLM instance. The configuration specifies a shell binary or system utility as the command value, with malicious payloads placed in the args array. When LiteLLM initializes the MCP server, it executes the supplied command as a child process. The attacker gains code execution with the same privileges as the LiteLLM service account. Because the CVSS vector indicates no authentication is required and the attack originates over the network, exposed deployments are directly reachable.

No verified public exploit code is currently available. See the LiteLLM Blog Post and the Ox Security Supply Chain Advisory for technical background.

Detection Methods for CVE-2026-30623

Indicators of Compromise

Unexpected child processes spawned by the LiteLLM process, particularly shells such as /bin/sh, /bin/bash, python, curl, or wget.
New or modified MCP server entries in LiteLLM configuration referencing unusual command values.
Outbound network connections initiated by the LiteLLM service to unfamiliar hosts shortly after MCP server registration.
Filesystem writes under LiteLLM's runtime directory that do not match normal application behavior.

Detection Strategies

Monitor process ancestry on hosts running LiteLLM and alert when the LiteLLM Python process forks non-model subprocesses.
Inspect HTTP request bodies to LiteLLM MCP configuration endpoints for command fields containing shell binaries or interpreters.
Correlate MCP configuration API calls with subsequent process execution events on the same host.

Monitoring Recommendations

Enable audit logging on all LiteLLM administrative and configuration endpoints, including MCP server registration.
Forward host process and network telemetry to a central data lake for retroactive hunting against known LiteLLM PIDs.
Baseline the set of executables normally invoked by LiteLLM and alert on deviations.

How to Mitigate CVE-2026-30623

Immediate Actions Required

Upgrade LiteLLM to a fixed release once available from the LiteLLM GitHub repository and remove version 1.18.10 from production.
Restrict network access to LiteLLM management and MCP configuration endpoints to trusted administrators only.
Audit existing MCP server entries and remove any definitions whose command or args values are not explicitly approved.
Run LiteLLM under a dedicated low-privilege user account to limit the impact of successful exploitation.

Patch Information

Refer to the vendor advisory at the LiteLLM Blog Post for the patched version and remediation guidance. Track updates through the LiteLLM GitHub repository release notes.

Workarounds

Disable the MCP server registration feature in environments where it is not required.
Place LiteLLM behind an authenticating reverse proxy and enforce role-based access on configuration endpoints.
Deploy LiteLLM inside a container or sandbox with a read-only filesystem and no outbound egress except to approved model providers.
Apply an allowlist at the operating system level (for example, AppArmor or SELinux) that restricts which binaries the LiteLLM process may execute.

bash

# Configuration example: run LiteLLM as an unprivileged user in a restricted container
docker run --rm \
  --user 10001:10001 \
  --read-only \
  --cap-drop=ALL \
  --security-opt no-new-privileges \
  --network litellm-egress-restricted \
  -p 4000:4000 \
  ghcr.io/berriai/litellm:<patched-version>