CVE-2026-12798

MEDIUM

BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery

Title source: cna

Description

A weakness has been identified in BerriAI litellm up to 1.82.2. Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader. This manipulation of the argument spec_path causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-372560 | BerriAI litellm MCP OpenAPI Spec Loader openapi_to_mcp_generator.py load_openapi_spec_async server-side request forgery

https://vuldb.com/vuln/372560

Signature, Permissions Required signature permissions-required

VDB-372560 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/372560/cti

Third Party Advisory third-party-advisory

CVE-2026-12798 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-12798

Third Party Advisory third-party-advisory

Submit #811290 | litellm latest Server-Side Request Forgery (SSRF) (CWE-918)

https://vuldb.com/submit/811290

Exploit exploit

https://gist.github.com/YLChen-007/c1104c529975699ba347feedfbe02c5a

Scores

CVSS v3 6.3

EPSS 0.0026

EPSS Percentile 17.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (4)

BerriAI/litellm 1.82.0

BerriAI/litellm 1.82.1

BerriAI/litellm 1.82.2

litellm/litellm < 1.82.2

Published Jun 21, 2026

Tracked Since Jun 21, 2026