{"id":"CVE-2026-12773","state":"PUBLISHED","title":"BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication","description":"A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.","publishedAt":"2026-06-21T03:15:08.647Z","updatedAt":"2026-07-15T01:22:10.736Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["BerriAI litellm"],"affected":[{"vendor":"BerriAI","product":"litellm","versions":[{"version":"1.59.0","status":"affected"},{"version":"1.59.1","status":"affected"},{"version":"1.59.2","status":"affected"},{"version":"1.59.3","status":"affected"},{"version":"1.59.4","status":"affected"},{"version":"1.59.5","status":"affected"},{"version":"1.59.6","status":"affected"},{"version":"1.59.7","status":"affected"},{"version":"1.59.8","status":"affected"}],"cpes":["cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*"],"modules":["MCP Proxy"]}],"references":["https://vuldb.com/vuln/372515","https://vuldb.com/vuln/372515/cti","https://vuldb.com/cve/CVE-2026-12773","https://vuldb.com/submit/811282","https://gist.github.com/YLChen-007/3cfaad10a69d7a15e4d4d458cb53309e","https://access.redhat.com/security/cve/CVE-2026-12773","https://bugzilla.redhat.com/show_bug.cgi?id=2491112","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12773.json"],"weaknesses":["CWE-287","CWE-303"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/12xxx/CVE-2026-12773.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12773","state":"PUBLISHED","datePublished":"2026-06-21T03:15:08.647Z","dateUpdated":"2026-07-15T01:22:10.736Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-06-20T09:26:26.143Z"},"containers":{"cna":{"title":"BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication","descriptions":[{"lang":"en","value":"A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure."}],"affected":[{"vendor":"BerriAI","product":"litellm","versions":[{"version":"1.59.0","status":"affected"},{"version":"1.59.1","status":"affected"},{"version":"1.59.2","status":"affected"},{"version":"1.59.3","status":"affected"},{"version":"1.59.4","status":"affected"},{"version":"1.59.5","status":"affected"},{"version":"1.59.6","status":"affected"},{"version":"1.59.7","status":"affected"},{"version":"1.59.8","status":"affected"}],"cpes":["cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*"],"modules":["MCP Proxy"]}],"references":[{"url":"https://vuldb.com/vuln/372515","name":"VDB-372515 | BerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authentication","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/372515/cti","name":"VDB-372515 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-12773","name":"CVE-2026-12773 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/811282","name":"Submit #811282 | litellm <= 1.59.8 Improper Authentication (CWE-287)","tags":["third-party-advisory"]},{"url":"https://gist.github.com/YLChen-007/3cfaad10a69d7a15e4d4d458cb53309e","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":7.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV3_0":{"version":"3.0","baseScore":7.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R","baseSeverity":"HIGH"}},{"cvssV2_0":{"version":"2.0","baseScore":7.5,"vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-287","type":"CWE","lang":"en","description":"Improper Authentication"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-06-21T03:15:08.647Z"},"timeline":[{"time":"2026-06-20T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-06-20T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-06-20T11:31:42.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Eric-c (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://vuldb.com/submit/811282","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-22T17:55:49.325110Z","id":"CVE-2026-12773","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-22T17:56:03.365Z"}},{"title":"litellm: BerriAI litellm: Improper authentication in MCP Proxy via UserAPIKeyAuth function","descriptions":[{"lang":"en","value":"A flaw was found in BerriAI litellm, within its MCP Proxy component. A remote attacker could exploit an improper authentication vulnerability in the UserAPIKeyAuth function. This could allow unauthorized access, potentially compromising the confidentiality, integrity, and availability of data within the system."}],"affected":[{"vendor":"Red Hat","product":"Exploit Intelligence","packageName":"exploit-intelligence-tech-preview/vulnerability-analysis-rhel9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:exploit_intelligence:0"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-26/lightspeed-chatbot-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","packageName":"ansible-automation-platform-27/lightspeed-chatbot-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-llama-stack-core-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mlflow-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-12773","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491112","name":"RHBZ#2491112","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12773.json","tags":["x_sadp-csaf-vex"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-303","description":"Incorrect Implementation of Authentication Algorithm","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:22:10.736Z"},"datePublic":"2026-06-21T03:15:08.647Z","timeline":[{"lang":"en","time":"2026-06-21T04:00:49.686Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-21T03:15:08.647Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Upgrade to litellm 1.81.16 or later. As a workaround, do not configure backend MCP servers with allow_all_keys: true, and restrict network access to the LiteLLM MCP proxy endpoints."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}