LiteLLM: MCP Proxy Has Improper Authentication
LiteLLM
More for LiteLLM RSS feed for LiteLLM
- Severity
- Critical, CVSS 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-12773
- Affects
- LiteLLM
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 21, 2026
- Source last modified
- October 25, 2026
Description
A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Description quoted from the NVD record.
Who is affected
LiteLLM, made by BerriAI, is a service that sits between your organization's apps and AI language models and passes requests between them. This flaw affects LiteLLM versions up to 1.59.8. The problem is in the MCP proxy feature, the part that lets AI assistants connect to outside tools. A weakness in how this part checks who is making a request could let an attacker get past its identity check, and the attack can be carried out remotely over a network. This flaw is rated Critical.
What to do
- Find out whether your organization uses LiteLLM, and who installed it or runs it: a staff member, a volunteer, or an IT provider.
- If someone in your organization runs it, ask them to check which version is installed. Versions up to
1.59.8are affected. - No fixed version is named for this flaw yet, so the person who runs LiteLLM should check the vendor advisory linked on this page for a fixed release and install it as soon as one is available.
- If an IT provider or vendor runs LiteLLM for your organization, send them this advisory and ask when the update will be done.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.