CVE-2026-12773

Katalog CVE

CVSS 9.8 · Critical EPSS 1,0%

Kerentanan Improper Authentication pada litellm. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Rincian

Terbit di NVD

21 Juni 2026

Terakhir diubah

15 Juli 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-303: Incorrect Implementation of Authentication Algorithm

EPSS (30 hari)

1,0% peluang dieksploitasi; lebih tinggi dari 62,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/YLChen-007/3cfaad10a69d7a15e4d4d458cb53309e exploit · advisory pihak ketiga
• https://vuldb.com/cve/CVE-2026-12773 advisory pihak ketiga · vdb entry
• https://vuldb.com/submit/811282 exploit · advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/372515 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/372515/cti permissions required · vdb entry
• https://access.redhat.com/security/cve/CVE-2026-12773
• https://bugzilla.redhat.com/show_bug.cgi?id=2491112
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12773.json