CVE-2026-12798 is a server-side request forgery vulnerability in BerriAI litellm affecting versions 1.82.0 through 1.82.2. The vulnerability resides in the load_openapi_spec_async function within litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py, specifically in the MCP OpenAPI Spec Loader component. By manipulating the spec_path argument, an attacker can cause the server to make unintended requests, potentially accessing internal resources or services. The vulnerability is remotely exploitable and public exploit code has been released. The vendor was notified early, but no official fix or remediation level has been published as of the data provided.

The SSRF vulnerability allows an attacker with low privileges to induce the server to make arbitrary HTTP requests. This can lead to unauthorized access to internal systems or services that are otherwise inaccessible externally. The CVSS 4.0 score of 5.3 (medium severity) reflects limited impact due to required privileges and low complexity of attack but with potential for information disclosure or further exploitation. There is no indication of known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access from the affected component to sensitive internal resources and monitor for unusual outbound requests. Avoid exposing the vulnerable function to untrusted inputs where possible.