CVE-2026-12774 BerriAI litellm MCP Server Connection Testing rest_endpoints.py _execute_with_mcp_client server-side request forgery

What is CVE-2026-12774?

CVE-2026-12774 is a medium-severity server-side request forgery vulnerability in BerriAI litellm, published on 21 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A security vulnerability has been detected in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function _execute_with_mcp_client of the file litellm/proxy/_experimental/mcp_server/rest_endpoints.py of the component MCP Server Connection Testing. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Weakness: CWE-918

Which versions are affected by CVE-2026-12774?

It affects 1 product.

Products include Litellm Litellm.

How do I fix CVE-2026-12774?

Upgrade to a fixed version.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2026-12774 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-12774 exists.

Other vulnerabilities in BerriAI litellm

• CVE-2026-42208 BerriAI LiteLLM SQL Injection Exploited Critical 9.3
• CVE-2026-59822 BerriAI LiteLLM Improper Authentication Exploited High 8.8
• CVE-2026-42271 BerriAI LiteLLM Command Injection Exploited High 8.7
• CVE-2024-5751 Remote Code Execution in BerriAI/litellm Critical 9.8
• CVE-2024-2952 Server-Side Template Injection in BerriAI/litellm Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-VO05387, GHSA-h9c7-cfj6-h8j6, MINI-3hwf-8c8r-694p, MINI-fw77-q95m-5f2j.