CVE Intelligence
Analysis AI-assisted

CVE-2026-12773: BerriAI LiteLLM MCP Proxy Improper Authentication

A weakness in the MCP Proxy component of BerriAI LiteLLM, classified as CWE-287 Improper Authentication, is described as affecting versions up to 1.59.8. NVD assigns a CVSS v3.1 base score of 9.8 (critical), and the record notes a publicly available exploit, while CISA KEV does not list this CVE. Defenders should prioritize upgrading to 1.59.9 or later and limiting network exposure of the proxy.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-12773 is a weakness in BerriAI LiteLLM up to version 1.59.8, located in the UserAPIKeyAuth function of the MCP Proxy component. The record classifies it as CWE-287 Improper Authentication. Sources consulted include the NVD entry and the VulDB entry.

Impact

  • According to the description, exploitation may lead to improper authentication, which could affect confidentiality, integrity and availability depending on the deployment.
  • The NVD CVSS v3.1 base score of 9.8 reflects a network-reachable attack with low complexity, no privileges required and no user interaction, as stated in the vector.
  • The actual business impact depends on what the proxy exposes and how it is deployed, which the record does not describe.

Affected products and versions

  • Product in the record: Litellm Litellm.
  • Range in the record: versions below 1.59.9.
  • The description refers to versions up to 1.59.8.
  • The record's fixes field is empty, so no fixed version is confirmed in the sources consulted.

Exploitation status

The description states that the exploit has been made available to the public and could be used for attacks, and the record includes references tagged as exploit. CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

  • Inventory LiteLLM deployments and identify any instance running a version below 1.59.9.
  • Plan an upgrade to 1.59.9 or later, as the affected range suggests, and validate the change against vendor release notes before rollout.
  • Until patched, limit network exposure of the MCP Proxy, place it behind trusted access controls, and rotate credentials that may have been exposed.

Detection guidance

  • Review proxy logs for unexpected successful authentications or unusual access patterns to MCP endpoints.
  • Correlate authentication events with source addresses and review API key usage that is new or unfamiliar.

Limitations of the available information

  • The record provides no vendor advisory, no confirmed fixed version and no detailed technical characterization.
  • Scores from other providers differ from the NVD score and are not reconciled here.
  • EPSS and SSVC data are not available in the record.

Frequently asked questions

What is CVE-2026-12773?

It is a weakness in the MCP Proxy component of BerriAI LiteLLM, classified as CWE-287 Improper Authentication. The description says it affects versions up to 1.59.8.

Is this vulnerability being actively exploited?

CISA KEV does not list this CVE, and no confirmed active exploitation appears in the sources consulted. The description does state that a public exploit is available, so exposed systems should be treated as at risk.

What should administrators do?

Identify LiteLLM instances below 1.59.9, plan an upgrade to 1.59.9 or later, and limit network exposure of the MCP Proxy until the change is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.