Disclosed weakness · no CVE recorded

LiteLLM could run an MCP tool excluded by policy

LiteLLM · LiteLLM Proxy

First documented disclosure · Review checkpoint

Summary

A caller could use an MCP tool that the proxy’s policy had removed from its list of permitted tools.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The proxy applied a tool-discovery policy without enforcing the same exclusion at execution.

Conditions required

A caller has MCP access on a deployment using a discovery guardrail.

Potential impact

A tool hidden from the available list could still perform work with its configured permissions.

Affected versions and configurations

The affected behavior is documented. The full version range is not established.

Fix and mitigation status

1.109.0 lists this correction; other release lines may differ.

Practical next steps

Use a release containing this correction. Restrict upstream tool privileges and check policy-denial logs.

Operating lesson

Enforce tool permissions at invocation even when discovery is filtered.

Evidence and limits

The project describes the correction in the linked public changes and lists it in 1.109.0. No CVE assignment or complete affected range was established.

Sources