CVE-2026-30623

Name of the Vulnerable Software and Affected Versions LiteLLM version 1.18.10

Description An architectural flaw in the MCP server creation functionality allows for remote code execution. The application permits users to add MCP servers through a JSON configuration where arbitrary values can be assigned to the command and args variables. Because LiteLLM executes these values on the host without validation, an attacker can run arbitrary operating system commands with the privileges of the LiteLLM process. Approximately 200,000 AI servers are potentially affected worldwide.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.