A critical, unauthenticated remote code execution bug just landed in a server that talks to LiteLLM. If you're running it, stop reading and go patch.
CVE-2026-37004 — CVSS-critical, no authentication required, arbitrary OS command execution.
The vulnerability
Ogham Mcp wraps BerriAI's LiteLLM, and versions 1.82.4 and earlier ship a server-side template injection (SSTI) bug in the /prompts/test endpoint. The root cause is almost embarrassingly simple: the endpoint feeds a user-supplied dotprompt_content parameter straight into an unsandboxed jinja2.Environment.
Jinja2 templates aren't just string formatting — they're a scripting language. Without sandboxing, a crafted template string can reach Python's object model and execute arbitrary OS commands. No login, no API key, no session. Just a crafted request.
An unauthenticated attacker sends one crafted request and gets shell-level command execution — no login required.
Why this one matters
Most of the advisories we cover are "upgrade when convenient." This isn't one of those.
MCPpedia Scoring System
Total: 100 ptsTemplate injection bugs like this tend to be trivially automatable — expect scanners to start probing /prompts/test endpoints on exposed LiteLLM instances shortly after public disclosure, if they haven't already.
What to do right now
If your stack includes Ogham Mcp or any deployment of LiteLLM at or below 1.82.4:
- Upgrade immediately. Don't wait for a maintenance window — this is unauthenticated RCE.
- Check your exposure. If
/prompts/testis reachable from the public internet, treat this as an active-incident-level priority, not a backlog ticket. - Audit logs for unusual requests to
/prompts/testcontaining template-like syntax ({{,{%) in thedotprompt_contentfield. - If you can't patch immediately, block or rate-limit the endpoint at the network layer as a stopgap — but don't treat that as a substitute for upgrading.
Unsandboxed Jinja2 rendering of user input is a well-known anti-pattern — this is the same class of bug that has burned Flask, Ansible, and dozens of templating-adjacent tools before. If you maintain a server that renders any user-supplied string as a template, check your sandboxing now, not just this one.
The bigger pattern
This advisory was published 2026-09-10, and it's a reminder that MCP servers wrapping fast-moving AI infrastructure (LiteLLM sits in front of dozens of model providers) inherit every vulnerability in that dependency chain. A single missing sandbox flag turned a prompt-testing convenience feature into a full remote shell.
Check MCPpedia's server pages for any dependency you run in production — that's exactly what advisory tracking exists for.
Patch first, read the CVE writeup later. This is not the week to be behind on LiteLLM.
MCP Security Weekly
Weekly CVE alerts, new server roundups, and MCP ecosystem insights. Free.
Keep reading
This article was written by AI, powered by Claude and real-time MCPpedia data. All facts and figures are sourced from our database - but AI can make mistakes. If something looks off, let us know.