BerriAI litellm versions 1.82.0 through 1.82.2 contain a server-side request forgery vulnerability in the load_openapi_spec_async function of the MCP OpenAPI Spec Loader component. This vulnerability arises from improper validation of the spec_path argument, enabling remote attackers to coerce the server into making unauthorized requests. The vulnerability is remotely exploitable and publicly disclosed. The vendor has been notified but has not yet released an official fix or mitigation. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an attacker to make the affected server perform arbitrary HTTP requests to internal or external systems, potentially bypassing firewall restrictions or accessing sensitive internal resources. The impact is rated medium due to limited confidentiality, integrity, and availability consequences as per the CVSS vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the vulnerable component and carefully validate or sanitize inputs to the load_openapi_spec_async function if possible. Monitor vendor channels for updates and apply patches promptly once available.