CVE-2026-30623

CVE-2026-30623 is a command injection vulnerability found in LiteLLM, specifically affecting version 1.18.10. This flaw resides within the Model Context Protocol (MCP) server creation functionality. It allows for remote code execution because the application accepts a JSON configuration where users can specify arbitrary command and argument values when registering a new MCP server. LiteLLM then passes these values to the host operating system without proper validation or sanitization. An attacker with a valid LiteLLM API key, and potentially the PROXY_ADMIN role in patched versions, can exploit this vulnerability by submitting a crafted JSON MCP server configuration. This configuration can include malicious payloads in the `args` array or specify a shell binary as the `command` value. When LiteLLM initializes the MCP server, it executes the supplied command as a child process, granting the attacker code execution with the privileges of the LiteLLM process. The issue has been addressed in LiteLLM versions v1.83.6-nightly and v1.83.7-stable and later.