This vulnerability in BerriAI litellm up to version 1.82.2 involves the _execute_with_mcp_client function in the file litellm/proxy/_experimental/mcp_server/rest_endpoints.py. It enables an attacker to perform server-side request forgery (SSRF), where the server can be tricked into making unauthorized requests. The vulnerability is remotely exploitable without user interaction and requires low privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. The vendor was contacted early, but no patch or official remediation has been announced as of the publication date.

Successful exploitation could allow an attacker to induce the server to send crafted requests to internal or external systems, potentially leading to information disclosure or interaction with unintended network resources. The vulnerability does not require user interaction and can be exploited remotely with low privileges. However, the overall impact is rated medium due to limited scope and complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications closely. No official mitigation or temporary workaround has been provided by the vendor at this time.