Loading vulnerability…
CVE-2026-30623 is an authenticated remote code execution vulnerability in LiteLLM’s MCP server creation functionality. LiteLLM allows MCP servers to be added through a JSON configuration that includes command and argument fields. In affected versions, these values are executed on the host without sufficient validation or restriction, allowing a user who can reach this functionality to supply arbitrary operating system commands. Research cited in the available material indicates the vulnerable path is tied to STDIO-based MCP server creation and that exploitation results in command execution in the context of the LiteLLM process. Additional reporting indicates the issue was addressed by restricting access to this functionality to the PROXY_ADMIN role.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
CVE-2026-30623 is the specific vulnerability referenced in a GitHub-related conversation and appears to be associated with LiteLLM container image versions, where one tested version showed a match and a later version showed no results found.
Referenced as another LiteLLM-related report during the same period, but no technical details are provided in the content.
A LiteLLM vulnerability where low-privilege internal-user keys could access a command-execution path, later restricted to the PROXY_ADMIN role.
A high- or critical-severity vulnerability identified by OX Security in LiteLLM as part of MCP-related exploitation paths stemming from unsafe command execution/design issues in the MCP ecosystem.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.