CVE-2026-12774: LiteLLM SSRF — MEDIUM

CISO Take

LiteLLM's experimental MCP server endpoint fails to validate user-supplied URLs during connection testing, allowing any authenticated user to forge server-side HTTP requests to arbitrary internal or external hosts. With a public exploit already published on GitHub, low attack complexity, and no user interaction required beyond a valid API key, this is immediately weaponizable by any principal with litellm API access — including trial users or leaked credentials. The highest-impact vector in cloud-deployed AI gateway contexts is SSRF to instance metadata services (AWS IMDS at 169.254.169.254, GCP at metadata.google.internal), which can yield instance role credentials enabling full cloud account takeover and exposure of all downstream LLM API keys configured in the proxy. Upgrade beyond litellm 1.82.2 immediately; if patching is not possible, disable the experimental MCP server feature and enforce strict egress filtering blocking RFC 1918 and link-local ranges from the proxy host.

Sources: NVD VulnDB OpenSSF ATLAS GitHub Advisory

What is the risk?

The CVSS 6.3 medium rating understates operational risk in cloud-deployed AI gateway contexts. SSRF with low privilege requirements means any authenticated litellm user — including those with minimal-scope API keys — can pivot to internal services without additional exploitation steps. LiteLLM functions as a multi-backend LLM proxy, meaning a successful SSRF chain can expose all configured provider API keys (OpenAI, Anthropic, Azure OpenAI, etc.) stored as environment variables, compounding the blast radius well beyond the CVE's stated confidentiality/integrity/availability impact. The package carries 24 prior CVEs and an OpenSSF Scorecard of 6.1/10, indicating systemic security debt rather than an isolated incident. Multi-tenant litellm deployments face the highest exposure: a single compromised user can attack infrastructure shared across all tenants.

How does the attack unfold?

Initial Access

Attacker authenticates to litellm proxy using any low-privilege API key and targets the experimental MCP server connection-testing REST endpoint.

AML.T0040

SSRF Exploitation

Attacker submits a crafted MCP server URL pointing to an internal target (e.g., AWS IMDS at 169.254.169.254 or an internal API) via the _execute_with_mcp_client function, which fetches it server-side without validation.

AML.T0049

Credential Harvesting

Server-side fetch returns cloud instance metadata including temporary IAM role credentials or internal service tokens, which the attacker reads from the API response.

AML.T0106

Impact

Attacker uses harvested cloud credentials to access S3/GCS buckets with training data or model artifacts, rotate or exfiltrate all downstream LLM provider API keys, and pivot laterally within the cloud account.

AML.T0085

Initial Access

Attacker authenticates to litellm proxy using any low-privilege API key and targets the experimental MCP server connection-testing REST endpoint.

AML.T0040

SSRF Exploitation

Attacker submits a crafted MCP server URL pointing to an internal target (e.g., AWS IMDS at 169.254.169.254 or an internal API) via the _execute_with_mcp_client function, which fetches it server-side without validation.

AML.T0049

Credential Harvesting

Server-side fetch returns cloud instance metadata including temporary IAM role credentials or internal service tokens, which the attacker reads from the API response.

AML.T0106

Impact

Attacker uses harvested cloud credentials to access S3/GCS buckets with training data or model artifacts, rotate or exfiltrate all downstream LLM provider API keys, and pivot laterally within the cloud account.

AML.T0085

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
55.3K OpenSSF 5.8 6 dependents Pushed 3d ago 49% patched ~47d to patch Full package profile →

Do you use LiteLLM? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

6 steps

Upgrade litellm to the first release above 1.82.2 that addresses this CVE — check the BerriAI/litellm GitHub releases and changelog immediately.
If an immediate upgrade is blocked, disable the experimental MCP server feature by removing or commenting out the MCP server configuration in your litellm proxy config.
Enforce strict egress filtering on the host running litellm: block outbound HTTP/HTTPS to 169.254.169.254 (AWS IMDS), 100.100.100.200 (Alibaba), metadata.google.internal, and all RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are not required for legitimate LLM backend calls.
Audit litellm proxy access logs for anomalous outbound requests to metadata endpoints or internal IP ranges originating from the MCP server connection-test endpoint.
Rotate all LLM provider API keys configured in the litellm proxy as a precaution if exposure cannot be ruled out.
Apply least-privilege IAM policies to the cloud instance role running litellm to minimize blast radius if instance credentials are harvested.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Code Execution Inference API Agent AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0085 - Data from AI Services AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

6.1.2 - AI risk assessment

NIST AI RMF

GOVERN 1.2 - Accountability for AI risk

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-12774?

LiteLLM's experimental MCP server endpoint fails to validate user-supplied URLs during connection testing, allowing any authenticated user to forge server-side HTTP requests to arbitrary internal or external hosts. With a public exploit already published on GitHub, low attack complexity, and no user interaction required beyond a valid API key, this is immediately weaponizable by any principal with litellm API access — including trial users or leaked credentials. The highest-impact vector in cloud-deployed AI gateway contexts is SSRF to instance metadata services (AWS IMDS at 169.254.169.254, GCP at metadata.google.internal), which can yield instance role credentials enabling full cloud account takeover and exposure of all downstream LLM API keys configured in the proxy. Upgrade beyond litellm 1.82.2 immediately; if patching is not possible, disable the experimental MCP server feature and enforce strict egress filtering blocking RFC 1918 and link-local ranges from the proxy host.

Is CVE-2026-12774 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-12774, increasing the risk of exploitation.

How to fix CVE-2026-12774?

1. Upgrade litellm to the first release above 1.82.2 that addresses this CVE — check the BerriAI/litellm GitHub releases and changelog immediately. 2. If an immediate upgrade is blocked, disable the experimental MCP server feature by removing or commenting out the MCP server configuration in your litellm proxy config. 3. Enforce strict egress filtering on the host running litellm: block outbound HTTP/HTTPS to 169.254.169.254 (AWS IMDS), 100.100.100.200 (Alibaba), metadata.google.internal, and all RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are not required for legitimate LLM backend calls. 4. Audit litellm proxy access logs for anomalous outbound requests to metadata endpoints or internal IP ranges originating from the MCP server connection-test endpoint. 5. Rotate all LLM provider API keys configured in the litellm proxy as a precaution if exposure cannot be ruled out. 6. Apply least-privilege IAM policies to the cloud instance role running litellm to minimize blast radius if instance credentials are harvested.

What systems are affected by CVE-2026-12774?

This vulnerability affects the following AI/ML architecture patterns: LLM proxy gateways, Agent frameworks, Multi-tenant AI API routing, MCP server deployments.

What is the CVSS score for CVE-2026-12774?

CVE-2026-12774 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

LLM proxy gatewaysAgent frameworksMulti-tenant AI API routingMCP server deployments

MITRE ATLAS Techniques

AML.T0040 AI Model Inference API Access

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0085 Data from AI Services

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: 6.1.2

NIST AI RMF: GOVERN 1.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function _execute_with_mcp_client of the file litellm/proxy/_experimental/mcp_server/rest_endpoints.py of the component MCP Server Connection Testing. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Exploitation Scenario

An attacker obtains a litellm API key — via credential leak, a shared team key, or a minimal-privilege trial account — and submits a connection-test request to the MCP server REST endpoint, supplying `http://169.254.169.254/latest/meta-data/iam/security-credentials/` as the target MCP server URL. The litellm server fetches this URL server-side and returns the AWS instance role name and temporary credentials (AccessKeyId, SecretAccessKey, SessionToken) to the attacker. The attacker uses these credentials to enumerate S3 buckets containing fine-tuned model weights or training datasets, read litellm's environment variables from SSM Parameter Store, and extract all downstream LLM provider API keys configured in the proxy. With a valid public PoC already published, this attack chain requires no specialized AI/ML knowledge and is executable in minutes.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.