GHSA-v4p8-mg3p-g94g: LiteLLM: Authenticated command execution via MCP stdio test endpoints

Summary

LiteLLM's two MCP preview endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, accepted full server configurations including command, args and env for the stdio transport. Calling them with a stdio configuration spawned the supplied command as a subprocess on the proxy host with the proxy process's privileges. Because the endpoints checked only for a valid proxy API key and no role, any authenticated user, including low-privilege internal-user keys, could run arbitrary commands on the host.

Mitigation

Fixed in 1.83.7. Both test endpoints now require the PROXY_ADMIN role. If upgrading is not immediately possible, block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the reverse proxy or API gateway.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• litellmPyPILLM dependency since 2023-07-27 · 55 tracked dependents

Topics

• Model Context Protocol

Related items

• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News
• MediumOn the hunt for ARTEX: understanding agentic attacks in AWS environmentsSimilar attack · Datadog Security Labs
• CriticalCVE-2026-102895: GPUStack Improper Authentication VulnerabilitySimilar attack · CISA Known Exploited Vulnerabilities
• HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database