CVE-2026-30623: LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration sp

criticalpublic exploitCVSS 9.8CVE-2026-30623

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values. LiteLLM executes these values on the host without validation, enabling attackers to run arbitrary operating system commands. Successful exploitation may result in remote code execution with the privileges of the LiteLLM process.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: critical — CVSS 9.8
Published: 2026-07-15
Last updated: 2026-07-16
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-30623

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-306231.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 75% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-30623	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] LiteLLM: Vulnerability allows execution of arbitrary code with service rightscert-bund

Recent advisories for LiteLLM

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

lowGHSA-72m8-9m7m-h278: LiteLLM: Custom Code Guardrails production endpoints bypass code safety checksghsa · 2026-07-22
highGHSA-7488-6r32-c95q: LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallbackghsa · 2026-07-22
lowGHSA-4g5m-c9r5-49xf: LiteLLM: Local file read via request-supplied OIDC file referencesghsa · 2026-07-22
mediumGHSA-5jmr-gcrj-2c9q: LiteLLM: Arbitrary file write via path traversal in Skills archive extractionghsa · 2026-07-22
high[NEW] [high] LiteLLM: Vulnerability allows execution of arbitrary code with service rightscert-bund · 2026-07-16
high[NEW] [high] LiteLLM: Multiple vulnerabilitiescert-bund · 2026-07-09