critique
CVE-2026-12773
litellm: BerriAI litellm: Improper authentication in MCP Proxy via UserAPIKeyAuth function
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (élevée), GHSA (moyenne).
Description
A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| echo pip::Echo OSV | litellm | 1.84.0 |
| minimos | airflow-3 | 3.3.1-r0 |
| pip::GitHub Security Advisory pip | litellm | 1.84.0 |
| seal pip::Seal Security Database | litellm, seal-litellm | 1.80.11+sp999, 1.83.14+sp2p2 |
Afficher les 5 entrées de 4 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| echo pip::Echo OSV | litellm | 1.84.0 |
| minimos | airflow-3 | 3.3.1-r0 |
| pip::GitHub Security Advisory pip | litellm | 1.84.0 |
| seal pip::Seal Security Database | litellm | 1.80.11+sp999, 1.83.14+sp2p2 |
| seal pip::Seal Security Database | seal-litellm | 1.80.11+sp999, 1.83.14+sp2p2 |
Références
- https://access.redhat.com/security/cve/CVE-2026-12773
- https://advisory.echohq.com/cve/CVE-2026-12773
- https://bugzilla.redhat.com/show_bug.cgi?id=2491112
- https://gist.github.com/YLChen-007/3cfaad10a69d7a15e4d4d458cb53309e
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
- https://nvd.nist.gov/vuln/detail/CVE-2026-12773
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12773.json