A vulnerability was found in BerriAI litellm up to 1.82.2 . It has been classified as critical . Affected by this vulnerability is the function load_openapi_spec_async of the file litellm/proxy/_experimental/mcp_server/openapi_to_mcp_generator.py of the component MCP OpenAPI Spec Loader . This manipulation of the argument spec_path causes server-side request forgery. The identification of this vulnerability is CVE-2026-12798 . It is possible to initiate the attack remotely. Furthermore, there is