LiteLLM MCP Unauthenticated Server Registration RCE (CVE-2026-30623)
LiteLLM's MCP server-registration endpoint can be reached without any login. An attacker sends it a malicious server configuration, and as soon as an agent session starts, LiteLLM executes the attacker's command on the host. This is a critical unauthenticated remote code execution flaw fixed in v1.83.7-stable.
How the attack works
The attacker sends an unauthenticated POST request to LiteLLM's MCP server-registration interface. The request registers a new STDIO-type MCP server whose configuration includes an attacker-chosen command, such as a bash shell running a payload. This registration succeeds because the endpoint does not check credentials. Later, when any user or agent starts a new session and LiteLLM initializes the registered MCP server, the malicious command runs directly on the LiteLLM host.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 81e69767-475a-4498-a08a-9dfc78645643
- Severity
- Critical
Why it matters
An outside attacker with no credentials can achieve full remote code execution on the server running LiteLLM, potentially giving them control of the AI proxy host and access to whatever it can reach, including API keys, connected models, and internal networks.
What you can do
- →Upgrade LiteLLM to v1.83.7-stable or later.
- →Until upgraded, block or restrict network access to the MCP server-registration endpoint so only trusted internal callers can reach it.
- →Review MCP server registration logs for STDIO configurations you did not create, especially ones invoking shells or interpreters.
- →Require authentication in front of the LiteLLM proxy (e.g. via a reverse proxy or API gateway) rather than relying solely on the application's own access controls.
Known benign look-alikes
- LiteLLM proxy admin documentation describing the MCP registration endpoint.
- Internal developer-onboarding scripts that register local STDIO servers in a controlled dev environment.
- Penetration-testing tooling that intentionally posts known-malicious payloads to validate the patch is effective.