CVE-2026-12773: BerriAI litellm MCP Proxy Authentication Bypass (CVSS 7.3)

Technical summary

CVE-2026-12773 is an authentication weakness in the UserAPIKeyAuth function located in litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py. The vulnerability stems from improper authentication logic (CWE-287: Improper Authentication; CWE-303: Incorrect Implementation of Authentication Algorithm) that permits attackers to manipulate the authentication mechanism and gain unauthorized access. The flaw is remotely exploitable with no authentication prerequisites and low attack complexity, meaning an attacker needs only network access and a straightforward request to trigger the vulnerability.

Business impact

Compromised litellm proxy instances expose LLM applications to unauthorized access, enabling attackers to abuse language models for malicious purposes, exfiltrate sensitive data processed by the LLM, or inject adversarial prompts. Organizations relying on litellm's proxy for multi-model orchestration, cost management, or API gateway functionality may experience service disruption, data loss, or reputational damage if this vulnerability is exploited. The public availability of exploit code significantly raises the likelihood of active attacks.

Affected systems

BerriAI litellm library versions up to and including 1.59.8 are affected. Any deployment using the MCP Proxy component with the UserAPIKeyAuth authentication handler is vulnerable. This includes organizations using litellm for LLM API abstraction, load balancing across model providers, or token management where the MCP server component is enabled.

Exploitability

This vulnerability has a CVSS 3.1 score of 7.3 (HIGH) with a network attack vector, low complexity, and no authentication or user interaction required. The public release of exploit code transforms this from a theoretical risk to an active threat. An attacker can remotely trigger the authentication bypass from any network location, making this vulnerability practical to exploit at scale without specialized tools or deep technical knowledge.

Remediation

Upgrade BerriAI litellm to the patched version released after 1.59.8. Consult the vendor's advisory for the specific fixed version number and deployment instructions. As an interim mitigation, restrict network access to litellm MCP Proxy instances using firewall rules, network segmentation, or API gateway policies to limit exposure to trusted networks only. Disable the MCP Proxy component if it is not actively required.

Patch guidance

Check the official BerriAI litellm GitHub repository or security advisories for the patched version addressing CVE-2026-12773. Apply the update across all affected instances in your environment, including development, staging, and production deployments. Verify the patch by confirming the version number and testing authentication enforcement in your proxy configuration. Monitor BerriAI's release notes and security channels for any follow-up fixes or detection signatures.

Detection guidance

Monitor litellm proxy logs for authentication failures, unexpected successful authentications from unknown sources, and requests with missing or malformed API key headers. Implement network-based detection for unusual traffic patterns to the MCP Proxy component. Organizations using SIEM solutions can correlate authentication bypass attempts with subsequent LLM API calls to suspicious prompts or data exfiltration patterns. Check running processes and configurations to identify if the MCP Proxy component is actively enabled in your deployment.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score, remote exploitability, public exploit availability, and direct impact on authentication—a critical security control. Unlike less accessible vulnerabilities, this one requires no authentication or user interaction to trigger, meaning any internet-connected litellm proxy is instantly at risk. Organizations using litellm in production should treat this as a priority-one remediation.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), no user interaction (UI:N), and impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The public availability of exploit code and the fundamental nature of the flaw (authentication bypass) elevate practical risk beyond the base score. Organizations with internet-facing litellm instances should consider this a critical issue.

Frequently asked questions