6 views
-/https://github.com/berriai/litellm/issues/30416
GitHub · issue

#30416 [Bug] Potential Context State Leakage in MCP Routing (_mcp_active_toolset_id) under Async Stream Interruption

  • State: open
  • Author: @QiuYucheng2003
  • Labels: bug, proxy

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

A bug happened!Through static source code analysis of the dynamic MCP route handling logic in proxy_server.py, a potential context state leakage vulnerability was identified. When a request matches a cached toolset, the server mutates the ASGI scope and sets a context variable using token = _mcp_active_toolset_id.set(toolset.toolset_id).

While this is wrapped in a try...finally block to reset the token, abrupt asynchronous stream interruptions (e.g., unhandled asyncio.CancelledError from request.receive during _stream_mcp_asgi_response, or deep unhandled socket drops) could potentially disrupt the cleanup lifecycle. In highly concurrent scenarios, this might leave polluted scope dictionaries or dirty _mcp_active_toolset_id context states for subsequent requests utilizing the same async worker.

### Steps to Reproduce

Note: This issue was identified via static security analysis. The following is the theoretical reproduction path under high concurrency. 1. Send a high volume of concurrent HTTP requests targeting a valid cached mcp_server_name (…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (2 events)
#0 of 0 · 31d18h52m49s ago — entered · #import:https:::github.com:berriai:litellm post #1982
The right issue is harder because it requires security triage, coordinated validation, and potentially broad changes across authorization and network-boundary controls; the left is comparatively localized to async lifecycle handling with focused tests.
#0 of 0 · 31d18h12m39s ago — current · #import:https:::github.com:berriai:litellm post #2632
The right-hand task spans asynchronous lifecycle semantics, cancellation handling, context isolation, and high-concurrency regression testing, creating substantially greater correctness and security risk. The left-hand task is comparatively localized to configuration serialization and UI behavior, with a narrower implementation and test surface.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search