LiteLLM MCP Server Configuration Remote Code Execution
First seen Jul 18, 2026 · Updated Jul 18, 2026 · CVSS 9.8
LiteLLM 1.18.10 allows any user who can submit MCP server configuration JSON to specify arbitrary OS commands and arguments that are executed unvalidated on the host. This gives an attacker remote code execution with the privileges of the LiteLLM process, a critical risk given the 9.8 CVSS score and the ease of exploitation.
Technical Analysis
The vulnerability resides in LiteLLM's feature for dynamically registering MCP servers, where a user-supplied JSON payload defines the 'command' and 'args' used to launch the server process. LiteLLM passes these values directly to the underlying OS process execution call without sanitization, allow-listing, or sandboxing. An attacker with access to the MCP server creation endpoint (which may be exposed to low-privileged users or API consumers depending on deployment) can specify a malicious command, achieving arbitrary code execution on the host running LiteLLM. This crosses the trust boundary between the agent orchestration layer and the underlying OS, effectively turning a configuration API into an unauthenticated or low-privilege command execution primitive, and could be leveraged to pivot into other connected agents, secrets, or infrastructure.
Affected Systems
LiteLLM; protocols: MCP
Detection Signatures
- Monitor LiteLLM logs for MCP server creation requests containing unexpected 'command' fields referencing shell interpreters (sh, bash, cmd, powershell) or unusual binaries.
- Alert on MCP server configuration payloads with 'args' containing shell metacharacters (;, |, &&, $(), backticks).
- Audit process execution logs on hosts running LiteLLM for child processes spawned by the LiteLLM service user that do not match expected MCP server binaries.
- Flag API calls to MCP server creation/management endpoints from unauthenticated or low-privileged tokens.
- Review outbound network connections originating from spawned MCP subprocesses for unexpected destinations.
Remediation Steps
- 1
Upgrade LiteLLM
Update to a patched LiteLLM release that validates or restricts MCP server command/args input; verify the vendor advisory for the fixed version.
- 2
Restrict MCP server creation privileges
Limit which users/roles can add or modify MCP server configurations, requiring admin-level authentication and audited approval workflows.
- 3
Implement command allow-listing
If custom logic is unavoidable, enforce a strict allow-list of permitted executables and reject arbitrary command/args combinations.
- 4
Sandbox MCP server processes
Run MCP server subprocesses in isolated containers or restricted execution environments (seccomp, gVisor, minimal-privilege service accounts) to limit blast radius if exploited.
- 5
Deploy runtime monitoring
Add EDR/host-based monitoring to detect anomalous child processes spawned by the LiteLLM service and alert on suspicious command patterns.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.