LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623)
LiteLLM's proxy has an endpoint for registering MCP servers that takes a 'command' and 'args' from the caller and runs them as a subprocess. Any user with a valid proxy API key — not necessarily an admin — can point that command at a shell and get arbitrary code execution on the proxy host.
How the attack works
An attacker who holds a valid LiteLLM proxy API key sends a request to create or register an MCP server, either through the mcp_servers JSON payload or the internal add_server format. Instead of a legitimate executable, the 'command' field contains a shell binary, and 'args' contains inline-exec flags like -c or -e carrying attacker-supplied commands. When LiteLLM initialises the MCP server, it passes these values straight to subprocess execution without validating them, so the shell command runs on the proxy host. This gives command execution to anyone with a normal (non-admin) API key, which is a much larger population than admin-only exploits.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1dd9db0a-5f8f-4ec4-8fbd-bf1dc2cf6b88
- Severity
- High
Why it matters
An organisation running a LiteLLM proxy that issues API keys to end-users, internal teams, or third-party callers can suffer full host compromise from any one of those key holders — code execution on the proxy server, potential access to other tenants' traffic and credentials, and a foothold for further lateral movement.
What you can do
- →Restrict who can create or modify MCP server configs on the LiteLLM proxy to trusted, admin-level identities only.
- →Validate or allowlist the 'command' field for MCP server registration — reject shell binaries and interpreter flags such as -c or -e in 'args'.
- →Audit existing MCP server configs for shell metacharacters or inline-exec patterns in command/args.
- →Monitor and log MCP server creation requests to the proxy, and alert on shell binaries or unexpected interpreter flags appearing in them.
Known benign look-alikes
- Legitimate LiteLLM MCP configs using npx/uvx/python -m with safe package names.
- Security advisory text quoting CVE-2026-30623 payloads.
- LiteLLM proxy configs with non-shell commands and no inline-exec flags.