CVE-2026-30623: LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application
highvulnerabilityLLM-Specific
security
Summary
LiteLLM version 1.18.10 has a remote code execution vulnerability in its MCP server creation feature, where the application accepts JSON configuration files with arbitrary command and args values and executes them without checking if they're safe, allowing attackers to run unauthorized operating system commands with the privileges of the LiteLLM process.
Vulnerability Details
EPSS (30-day exploit probability)
EPSS: 0.0%
Disclosure Date
July 15, 2026
Classification
Attack Type
Supply Chain
Attack SophisticationModerate
Impact (CIA+S)
integrityconfidentiality
Affected Vendors
LangChain
Related Issues
Monthly digest — independent AI security research
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-30623
First tracked: July 16, 2026 at 02:07 AM
Classified by LLM (prompt v3) · confidence: 92%