CVE-2026-30623: Command Injection
LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the MCP server JSON configuration does not accept user-controlled arbitrary "command" and "args" values; only allow predefined trusted values.
LiteLLM MCP server JSON configuration command/args values (MCP server definition) = Use only trusted, fixed command/args and reject/avoid user-supplied arbitrary values - Compensating control
Restrict access to the LiteLLM MCP server creation functionality/config endpoint so only trusted users can provide MCP server JSON (since arbitrary command and args values are executed on the host without validation).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30623?
CVE-2026-30623 has a critical severity rating of 9.8 on the CVSS scale.
What type of vulnerability is CVE-2026-30623?
CVE-2026-30623 is a remote code execution vulnerability caused by command injection in LiteLLM.
How do I fix CVE-2026-30623?
To fix CVE-2026-30623, update LiteLLM to version 1.18.11 or apply the appropriate patches provided by the developer.
What consequences can result from exploiting CVE-2026-30623?
Exploiting CVE-2026-30623 can allow an attacker to execute arbitrary commands on the host system.
Is CVE-2026-30623 easy to exploit?
Yes, CVE-2026-30623 can be easily exploited due to the lack of validation when adding MCP servers via JSON configuration.