kritisch
CVE-2026-12773
litellm: BerriAI litellm: Improper authentication in MCP Proxy via UserAPIKeyAuth function
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), GHSA (mittel).
Beschreibung
A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| echo pip::Echo OSV | litellm | 1.84.0 |
| minimos | airflow-3 | 3.3.1-r0 |
| pip::GitHub Security Advisory pip | litellm | 1.84.0 |
| seal pip::Seal Security Database | litellm, seal-litellm | 1.80.11+sp999, 1.83.14+sp2p2 |
Alle 5 Einträge aus 4 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| echo pip::Echo OSV | litellm | 1.84.0 |
| minimos | airflow-3 | 3.3.1-r0 |
| pip::GitHub Security Advisory pip | litellm | 1.84.0 |
| seal pip::Seal Security Database | litellm | 1.80.11+sp999, 1.83.14+sp2p2 |
| seal pip::Seal Security Database | seal-litellm | 1.80.11+sp999, 1.83.14+sp2p2 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2026-12773
- https://advisory.echohq.com/cve/CVE-2026-12773
- https://bugzilla.redhat.com/show_bug.cgi?id=2491112
- https://gist.github.com/YLChen-007/3cfaad10a69d7a15e4d4d458cb53309e
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
- https://nvd.nist.gov/vuln/detail/CVE-2026-12773
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12773.json