CVE-2026-42271highunder attackCWE-77CWE-78

CVE-2026-42271: high-severity vulnerability in BerriAI litellm

LiteLLM: Authenticated command execution via MCP stdio test endpoints

Published · Updated

Follow this CVE+ Monitor litellm+ Monitor litellm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.7epss 91%
from disclosure to weapon12 days
Published on NVDMay 8
1st PoC+12d
metasploitApr 21
CISA KEV+31d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
3 products (8 components)
Red Hat OpenShift AI 3.4 · Red Hat OpenShift AI 2.25 · Red Hat OpenShift AI 3.3
fix ↗
Not affected
6 products (19 components) — because the vulnerable code is not present in the product
Red Hat OpenShift AI 2.25 · Red Hat OpenShift AI 3.3 · Red Hat OpenShift AI 3.4 · Red Hat Ansible Automation Platform 2 · Exploit Intelligence · and others 1
Action required by CISAfederal deadline: 2026-06-22

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

LiteLLM proxy server had two test endpoints that allowed authenticated users to execute arbitrary commands on the host by providing a malicious command in the MCP server configuration. Any user with a valid API key, even with low privileges, could exploit this to run code with the proxy's privileges.

Technical detail

CWE-77/CWE-78 command injection vulnerability in POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints (versions 1.74.2–1.83.6). Attackers with valid proxy API keys could supply arbitrary commands in the stdio transport configuration (command, args, env fields), which were executed as subprocesses without role-based access control, leading to unauthenticated code execution on the proxy host.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
Affected products
BerriAI · litellm
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — BerriAI litellm

In the same product, most dangerous first.

CVE-2026-42208CRITICALLiteLLM: SQL injection in Proxy API key verificationEPSS 89.4%KEVCVE-2026-59822HIGHLiteLLM: MCP Authentication Bypass via OAuth2 Passthrough FallbackEPSS 0.8%KEVCVE-2026-35029HIGHLiteLLM affected by privilege escalation via unrestricted proxy configuration endpointEPSS 38.6%CVE-2026-49468CRITICALLiteLLM: Authentication Bypass via Host Header InjectionEPSS 3.0%CVE-2026-47101HIGHLiteLLM < 1.83.14 Privilege Escalation via API Key GenerationEPSS 1.2%CVE-2026-12773MEDIUMBerriAI litellm MCP Proxy user_api_key_auth_mcp.py UserAPIKeyAuth improper authenticationEPSS 1.0%