LiteLLM proxy's MCP 'test connection' endpoint let any authenticated user run OS commands, alongside three other agent-tooling auth bypasses

Undisclosed·LiteLLM proxy (MCP server integration, custom-code guardrail, prompt-testing endpoint)Fixed

LiteLLM's proxy exposed POST /mcp-rest/test/connection and /mcp-rest/test/tools/list, meant to preview an MCP server before saving it, but they accepted a full stdio server config and actually spawned the supplied `command` as a subprocess on the proxy host with only a valid API key required and no admin-role check — so any authenticated user, including low-privilege internal-user keys, could run arbitrary commands. The same disclosure batch (4 advisories, same day) covered a /user/update endpoint that let a user escalate their own role, a sandbox escape in the custom-code guardrail feature, and a server-side template injection in /prompts/test.

Blast radius

Demonstrated authenticated remote command execution on the LiteLLM proxy host (CVSS 3.1 8.8 High / CVSS 4.0 8.7), reachable by any API-key holder regardless of privilege level, plus a related privilege-escalation, guardrail sandbox-escape and template-injection bug in the same release. No named victim organisation or confirmed in-the-wild exploitation was disclosed, and the number of affected deployments before patching is not disclosed.

Root cause

The 'test before you save' preview endpoints for MCP tool configuration (and similarly the prompt-test endpoint) were built to actually execute the supplied command/template rather than statically validating it, and were gated only by authentication, not by the same admin-role authorization the corresponding save endpoints already had.

How it was caught

Identified and reported through coordinated vulnerability disclosure and published as a GitHub Security Advisory / CVE, not discovered via an in-production incident.

What changed

Fixed in litellm 1.83.7: the MCP test endpoints now require the PROXY_ADMIN role, matching the save endpoint; companion fixes to /user/update, the custom-code guardrail sandbox, and /prompts/test shipped in the same release. Vendor also published a reverse-proxy blocking workaround for operators who cannot upgrade immediately.

Take-awayAny 'preview' or 'test' endpoint that lets a user validate agent/tool configuration (MCP server commands, prompt templates, custom guardrail code) is a code-execution surface and must carry the exact same authorization checks as the endpoint that persists that configuration.