kritik
CVE-2026-12773
litellm: BerriAI litellm: Improper authentication in MCP Proxy via UserAPIKeyAuth function
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA5.5CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Red Hat7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), GHSA (orta).
Açıklama
A weakness has been identified in BerriAI litellm up to 1.59.8. Affected is the function UserAPIKeyAuth of the file litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py of the component MCP Proxy. Executing a manipulation can lead to improper authentication. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| echo pip::Echo OSV | litellm | 1.84.0 |
| minimos | airflow-3 | 3.3.1-r0 |
| pip::GitHub Security Advisory pip | litellm | 1.84.0 |
| seal pip::Seal Security Database | litellm, seal-litellm | 1.80.11+sp999, 1.83.14+sp2p2 |
4 kaynaktaki 5 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| echo pip::Echo OSV | litellm | 1.84.0 |
| minimos | airflow-3 | 3.3.1-r0 |
| pip::GitHub Security Advisory pip | litellm | 1.84.0 |
| seal pip::Seal Security Database | litellm | 1.80.11+sp999, 1.83.14+sp2p2 |
| seal pip::Seal Security Database | seal-litellm | 1.80.11+sp999, 1.83.14+sp2p2 |
Referanslar
- https://access.redhat.com/security/cve/CVE-2026-12773
- https://advisory.echohq.com/cve/CVE-2026-12773
- https://bugzilla.redhat.com/show_bug.cgi?id=2491112
- https://gist.github.com/YLChen-007/3cfaad10a69d7a15e4d4d458cb53309e
- https://github.com/BerriAI/litellm
- https://github.com/BerriAI/litellm/commit/73869f0faf7d11ee21adcb5f91b8c33a340b6c2c
- https://nvd.nist.gov/vuln/detail/CVE-2026-12773
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12773.json