Threat · curated 8 Aug 2026
CVE-2026-30623 - Exploits & Severity
First reported feedly.com
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
CVE-2026-30623 lets unauthenticated attackers run arbitrary OS commands on hosts running the widely used LiteLLM proxy by abusing MCP server configuration, turning the AI tool-integration layer into a direct RCE vector across many downstream products.
CVE-2026-30623 is a critical (CVSS 9.8) OS command injection flaw in LiteLLM 1.18.10's MCP server creation feature: the application executes arbitrary command and args values supplied via JSON MCP server configuration without validation. An unauthenticated network attacker can achieve remote code execution with the privileges of the LiteLLM process; patches are available for LiteLLM and related products (DocsGPT, Flowise, Bisheng), while Windsurf and Langchain-Chatchat were reported still vulnerable.
Summary
CVE-2026-30623 is a critical (CVSS 9.8) OS command injection vulnerability (CWE-78) in LiteLLM 1.18.10's MCP server creation functionality. The application lets users register Model Context Protocol servers through a JSON configuration that specifies arbitrary command and args values, which LiteLLM then executes on the host without validation, enabling an unauthenticated network attacker to run arbitrary OS commands with the privileges of the LiteLLM process.[0]
Despite the maximal-severity score, the aggregated evidence reports no confirmed exploit and no evidence of in-the-wild exploitation, with all analyzed exploit URLs assessed as non-exploitable. A patch is available (LiteLLM v1.83.7-stable), and the issue sits within a broader class of stdio/MCP command-injection weaknesses affecting multiple AI-agent frameworks, making this a disclosure-and-patch narrative rather than an observed campaign.[0]
Attack chain
- Configuration abuse: An attacker submits a malicious MCP server definition via JSON configuration, specifying attacker-controlled command and args fields.[0]
- Command execution: LiteLLM executes the supplied command and args values on the host without validation, resulting in arbitrary OS command execution with the privileges of the LiteLLM process.[0]
Disclosure timeline
| Date | Event |
|---|---|
| Apr 17, 2026 | Feedly found the first article mentioning CVE-2026-30623 (gbhackers.com).[0] |
| May 1, 2026 | Threat intelligence report noted LiteLLM v1.83.7-stable patch and fixes for DocsGPT, Flowise, and Bisheng, while Windsurf and Langchain-Chatchat remained vulnerable.[0] |
| Jul 15, 2026 | NVD published the first details for CVE-2026-30623; GitHub Advisories released security advisory GHSA-gw7c-8jfv-4mj2.[0] |
| Jul 16, 2026 | RedHat CVE advisory released; a CVSS base score of 9.8 was assigned.[0] |
| Jul 17, 2026 | FIRST assigned an EPSS score of 0.94% (percentile 57.1%).[0] |
| Jul 21, 2026 | FIRST assigned an updated EPSS score of 1.19% (percentile 64.5%).[0] |
How it works
LiteLLM allows users to add MCP (Model Context Protocol) servers via a JSON configuration that specifies arbitrary command and args values. LiteLLM executes these values directly on the host without validation or sanitization, producing an OS command injection (CWE-78). Because the MCP server configuration path can be reached by an unauthenticated attacker over the network with low attack complexity and no user interaction, the result is unauthenticated remote code execution at the privilege level of the LiteLLM process.[0]
This weakness belongs to a broader pattern of stdio/MCP command-injection issues across agentic AI frameworks, where a defined MCP server can execute shell commands; related disclosures cited in the reporting include Flowise (CVE-2026-40933) and the wider MCP SDK stdio command-injection discussion.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| LiteLLM | 1.18.10 (MCP server creation functionality) | Patched — update beyond 1.18.10; v1.83.7-stable provides a fix.[0] |
| DocsGPT, Flowise, Bisheng | Affected by the related stdio/MCP command-injection class | Fixes released[0] |
| Windsurf, Langchain-Chatchat | Affected by the related stdio/MCP command-injection class | Reported still vulnerable as of May 1, 2026[0] |
Key takeaways
- CVE-2026-30623 is a CVSS 9.8 unauthenticated RCE in LiteLLM 1.18.10 caused by executing attacker-controlled command/args from MCP server JSON configuration without validation; a patch is available.[0]
- Despite the critical score, the evidence shows no confirmed exploit or in-the-wild exploitation, with EPSS still low (1.19%), so this is best treated as vulnerability disclosure requiring prompt patching rather than active-campaign response.[0]
- The vulnerability is part of a wider stdio/MCP command-injection problem affecting multiple agentic AI frameworks (e.g., Flowise, DocsGPT, Bisheng, Windsurf, Langchain-Chatchat), so defenders should audit all MCP STDIO definitions across their AI tooling.[0]
Defensive actions
- Update LiteLLM to a patched version beyond 1.18.10 (e.g., v1.83.7-stable).: A patch is available that remediates the MCP server command-injection vulnerability.[0]
- Implement input validation and sanitization for MCP server configuration parameters, particularly the command and args fields.: The vulnerability stems from LiteLLM executing unvalidated command and args values from JSON configuration.[0]
- Restrict access to MCP server configuration endpoints to authenticated and authorized users only.: The flaw is exploitable by unauthenticated network attackers, so limiting who can configure MCP servers reduces exposure.[0]
- Monitor LiteLLM process execution for suspicious or unexpected command invocations, and audit all STDIO MCP definitions against vendor advisories.: Exploitation manifests as arbitrary OS commands spawned by the LiteLLM process; the broader MCP command-injection class warrants auditing all stdio definitions.[0]