CVE-2026-42271

Published May 8, 2026

Last updated 17 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-42271 is a command injection vulnerability found in LiteLLM, an open-source proxy server designed to expose Large Language Model (LLM) APIs in an OpenAI-compatible format. This flaw affects LiteLLM versions from 1.74.2 up to, but not including, 1.83.7. The vulnerability resides in two Model Context Protocol (MCP) preview endpoints, `POST /mcp-rest/test/connection` and `POST /mcp-rest/test/tools/list`, which incorrectly accepted full server configurations, including fields for `command`, `args`, and `env` used by the `stdio` transport. Exploitation of CVE-2026-42271 allows an authenticated attacker, even with a low-privilege API key, to execute arbitrary commands on the LiteLLM proxy host. This occurs because the vulnerable endpoints would spawn the supplied command as a subprocess with the privileges of the proxy process. The issue has been patched in LiteLLM version 1.83.7, which introduced additional authorization controls requiring the `PROXY_ADMIN` role for these test endpoints. Furthermore, this vulnerability can be chained with CVE-2026-48710, a Starlette "BadHost" host header validation bypass, to achieve unauthenticated remote code execution.

Description: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
Source: security-advisories@github.com
NVD status: Analyzed
Products: litellm

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Known exploits

Data from CISA

Vulnerability name: BerriAI LiteLLM Command Injection Vulnerability
Exploit added on: Jun 8, 2026
Exploit action due: Jun 22, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

security-advisories@github.com: CWE-77

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D249DFDB-5D0D-4053-A997-0900F77F9A13",
            "versionEndExcluding": "1.83.7",
            "versionStartIncluding": "1.74.2",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.