CVE-2026-12773: LiteLLM auth bypass — HIGH

CISO Take

CVE-2026-12773 is an improper authentication flaw (CWE-287) in litellm's experimental MCP server proxy, where the UserAPIKeyAuth function fails to enforce authentication, allowing any unauthenticated remote attacker to access LLM inference routes without valid credentials. The CVSS vector is AV:N/AC:L/PR:N/UI:N — fully remote, trivially exploitable, requiring nothing from the victim — and a public proof-of-concept exploit is already live on GitHub despite the 'experimental' label on the component. With 24 prior CVEs in the litellm package, an OpenSSF Scorecard of 6.1/10, and a package risk score of 79/100, this is not an isolated incident but a pattern of inadequate security in a widely-deployed LLM gateway. Upgrade beyond 1.59.8 immediately; if patching is not yet possible, disable the MCP proxy component in litellm configuration or firewall the proxy port from untrusted networks and rotate any LLM provider API keys the instance had access to.

Sources: NVD OpenSSF ATLAS VulnDB

What is the risk?

High risk. The vulnerability is remotely exploitable with no authentication, no privileges, and no user interaction required (CVSS 7.3). A public exploit exists on GitHub and the CVE description explicitly confirms it has been made available for attacks. The affected component is labeled 'experimental,' which may limit deployment surface, but MCP protocol adoption in agentic AI stacks is accelerating rapidly and many production litellm deployments already enable it. The lack of a documented patched version at time of disclosure extends the exposure window. Repeated CVEs in this package (24 total) and a below-average OpenSSF score suggest structural security debt that increases confidence this class of vulnerability will recur.

How does the attack unfold?

Discovery

Attacker scans for exposed litellm proxy instances on port 4000 via Shodan or active probing, confirming version ≤1.59.8 and MCP proxy availability through endpoint enumeration at /mcp/ routes.

AML.T0006

Authentication Bypass

Attacker sends a crafted request exploiting the UserAPIKeyAuth flaw (CWE-287) in the MCP proxy, bypassing authentication entirely without a valid API key using the public exploit.

AML.T0049

Unauthorized Inference Access

With authentication bypassed, attacker gains full access to all LLM inference routes and issues arbitrary requests to configured providers (OpenAI, Anthropic, etc.) billed to the victim.

AML.T0040

Credential Harvesting & Impact

Attacker extracts LLM provider API keys from the proxy configuration for out-of-band use and runs cost-harvesting queries, exhausting the victim's LLM provider budgets and stealing credentials.

AML.T0106

Discovery

Attacker scans for exposed litellm proxy instances on port 4000 via Shodan or active probing, confirming version ≤1.59.8 and MCP proxy availability through endpoint enumeration at /mcp/ routes.

AML.T0006

Authentication Bypass

Attacker sends a crafted request exploiting the UserAPIKeyAuth flaw (CWE-287) in the MCP proxy, bypassing authentication entirely without a valid API key using the public exploit.

AML.T0049

Unauthorized Inference Access

With authentication bypassed, attacker gains full access to all LLM inference routes and issues arbitrary requests to configured providers (OpenAI, Anthropic, etc.) billed to the victim.

AML.T0040

Credential Harvesting & Impact

Attacker extracts LLM provider API keys from the proxy configuration for out-of-band use and runs cost-harvesting queries, exhausting the victim's LLM provider budgets and stealing credentials.

AML.T0106

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
55.3K OpenSSF 5.8 6 dependents Pushed 3d ago 49% patched ~47d to patch Full package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

7.3 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 46% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

6 steps

PATCH

Upgrade litellm to any version released after 1.59.8 that addresses this CVE. Monitor the BerriAI/litellm GitHub releases page actively.
DISABLE

If the MCP proxy is not operationally required, disable the experimental MCP server component in litellm proxy configuration immediately.
NETWORK RESTRICT

Firewall the litellm proxy port (default 4000) to trusted internal networks; never expose it directly to the internet without perimeter authentication.
ROTATE CREDENTIALS

Audit and rotate all LLM provider API keys (OpenAI, Anthropic, Azure, etc.) configured in any potentially exposed litellm instances.
DETECT

Review litellm proxy access logs for unauthenticated or anomalous requests to MCP proxy endpoints (/mcp/*), particularly from unexpected source IPs or with missing or malformed authorization headers.
INVENTORY

Identify all litellm deployments across your environment including those embedded in CI/CD pipelines, agent frameworks, and developer tooling.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Data Leakage API Inference Agent AML.T0034 - Cost Harvesting AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Access control for AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms to sustain the value of deployed AI systems

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-12773?

CVE-2026-12773 is an improper authentication flaw (CWE-287) in litellm's experimental MCP server proxy, where the UserAPIKeyAuth function fails to enforce authentication, allowing any unauthenticated remote attacker to access LLM inference routes without valid credentials. The CVSS vector is AV:N/AC:L/PR:N/UI:N — fully remote, trivially exploitable, requiring nothing from the victim — and a public proof-of-concept exploit is already live on GitHub despite the 'experimental' label on the component. With 24 prior CVEs in the litellm package, an OpenSSF Scorecard of 6.1/10, and a package risk score of 79/100, this is not an isolated incident but a pattern of inadequate security in a widely-deployed LLM gateway. Upgrade beyond 1.59.8 immediately; if patching is not yet possible, disable the MCP proxy component in litellm configuration or firewall the proxy port from untrusted networks and rotate any LLM provider API keys the instance had access to.

Is CVE-2026-12773 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-12773, increasing the risk of exploitation.

How to fix CVE-2026-12773?

1. PATCH: Upgrade litellm to any version released after 1.59.8 that addresses this CVE. Monitor the BerriAI/litellm GitHub releases page actively. 2. DISABLE: If the MCP proxy is not operationally required, disable the experimental MCP server component in litellm proxy configuration immediately. 3. NETWORK RESTRICT: Firewall the litellm proxy port (default 4000) to trusted internal networks; never expose it directly to the internet without perimeter authentication. 4. ROTATE CREDENTIALS: Audit and rotate all LLM provider API keys (OpenAI, Anthropic, Azure, etc.) configured in any potentially exposed litellm instances. 5. DETECT: Review litellm proxy access logs for unauthenticated or anomalous requests to MCP proxy endpoints (/mcp/*), particularly from unexpected source IPs or with missing or malformed authorization headers. 6. INVENTORY: Identify all litellm deployments across your environment including those embedded in CI/CD pipelines, agent frameworks, and developer tooling.

What systems are affected by CVE-2026-12773?

This vulnerability affects the following AI/ML architecture patterns: LLM proxy and gateway deployments, MCP server integrations, Agent frameworks using litellm as LLM backend, Multi-provider LLM routing infrastructure, AI API management and cost control platforms.

What is the CVSS score for CVE-2026-12773?

CVE-2026-12773 has a CVSS v3.1 base score of 7.3 (HIGH). The EPSS exploitation probability is 0.61%.

What is the AI security impact?

Affected AI Architectures

LLM proxy and gateway deploymentsMCP server integrationsAgent frameworks using litellm as LLM backendMulti-provider LLM routing infrastructureAI API management and cost control platforms

MITRE ATLAS Techniques

AML.T0034 Cost Harvesting

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Exploitation Scenario

An attacker scans the internet for exposed litellm proxy instances on port 4000 using Shodan or active probing, identifying version strings via response headers or the /health endpoint. They confirm the MCP proxy is enabled by probing /mcp/ endpoints. Using the public exploit from the GitHub gist, they craft an HTTP request to the MCP proxy that manipulates the UserAPIKeyAuth check — likely by omitting or malforming the API key in a way the flawed validation logic accepts as valid. Once inside, they issue LLM inference requests routed through all configured provider keys, running up charges on the victim's OpenAI or Anthropic accounts. They then enumerate the litellm configuration API to extract raw API keys for out-of-band use, effectively stealing all LLM provider credentials stored in the instance. In an enterprise environment, they may pivot to other internal services accessible from the proxy's trusted network position.

Weaknesses (CWE)

CWE-287 Improper Authentication Primary CWE-287 Improper Authentication

CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.