VULNERABILITY INTELLIGENCE

CVE-2026-12774

CVSS score6.3 MEDIUM

EPSS probability0.40%

CISA KEVNot currently listed

Published2026-06-21

Last modified2026-10-25

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Description

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function _execute_with_mcp_client of the file litellm/proxy/_experimental/mcp_server/rest_endpoints.py of the component MCP Server Connection Testing. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Weakness classification

cna@vuldb.com: CWE-918

Primary references

cna@vuldb.com — Exploit, Third Party Advisory
cna@vuldb.com — Third Party Advisory, VDB Entry
cna@vuldb.com — Third Party Advisory, Exploit, VDB Entry
cna@vuldb.com — Third Party Advisory, VDB Entry
cna@vuldb.com — Permissions Required, VDB Entry