LiteLLM MCP Server Creation Authenticated argv Injection (CVE-2026-30623) - ATR-2026-00543 (d427749e-9961-5e97-9ee9-40d10d8cffaa)
Detects CVE-2026-30623 (CVSS HIGH, CWE-78): LiteLLM's proxy MCP server creation endpoint accepts 'command' and 'args' fields from an authenticated caller (proxy API key required) and passes them directly to subprocess execution without validation. An attacker with a valid LiteLLM proxy API key can create a malicious MCP server configuration that executes arbitrary commands on the proxy host when the MCP server is initialised. Unlike CVE-2026-30617 (LangChain-ChatChat, unauthenticated) this requires a valid proxy API key but not admin access — widening the attack surface in any LiteLLM deployment that issues keys to end-users or third-party callers. The LiteLLM proxy MCP API accepts JSON with 'mcp_servers' or uses the internal 'add_server' / server registration format with 'command' and 'args'. Detection covers: (a) LiteLLM proxy MCP server creation payload with shell binary in command; (b) LiteLLM MCP config with interpreter + -c/-e inline-exec in args; (c) LiteLLM POST /mcp endpoint with shell metacharacters in command/args; (d) Explicit CVE-2026-30623 / LiteLLM MCP exploitation framing.