CVE-2026-42271

LiteLLM acts like a “front door” that your apps use to call AI models. This bug lets a person with a valid API key trick the system into running commands on the server, like handing someone the power to type commands on your computer. Because it’s already being exploited, the main risk is that an attacker could use it to steal data, disrupt services, or set up further access.

This matters if you run LiteLLM (or OpenShift AI) and you have a LiteLLM proxy instance that is reachable and configured in a way that exposes the MCP stdio test endpoints. The vulnerability is triggered by making specific “test” requests while presenting a valid LiteLLM proxy API key, including low-privilege internal user keys.

This is only a real risk if an attacker can reach the LiteLLM endpoints over the network and has a valid LiteLLM API key.

This is RED because CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities list with an explicit remediation deadline, and reporting confirms active exploitation in the wild. Attackers are using valid (even low-privilege) API keys to trigger command execution on the server, so delay directly increases your chance of compromise.

Confirm exposure

• Identify which product you run: litellm and/or openshift ai.
• Check the deployed version(s):
  • Affected litellm versions are 1.74.2 through 1.83.6.
  • Affected openshift ai is not specified by range in the findings; treat your deployment as affected unless it’s confirmed patched to the fixed release.
• Confirm whether your LiteLLM proxy is reachable from the network by clients who can present a LiteLLM proxy API key (even an internal low-privilege key).

Patch / upgrade (preferred)

• Upgrade litellm to 1.83.7.
• Upgrade openshift ai to 2.25.8.
• If you manage this via containers/deployments, roll the updated version through your normal release process.

If patching must wait (temporary containment)

• Immediately restrict who can call the LiteLLM proxy:
  • Rotate/revoke any API keys that are not strictly required.
  • Ensure only trusted admin users/services have API keys.
• Block or reduce access to the MCP testing functionality from non-admin clients:
  • Temporarily restrict traffic to the MCP test endpoints (the two endpoints mentioned in the findings: /mcp-rest/test/connection and /mcp-rest/test/tools/list) at the reverse proxy / firewall level.

What to check after upgrading

• Review server/application logs for activity involving:
  • POST /mcp-rest/test/connection
  • POST /mcp-rest/test/tools/list
• Look for:
  • repeated test calls from unexpected clients
  • unusual request payloads targeting MCP stdio configuration
  • unexpected child processes spawned by the LiteLLM service user
• If you find suspicious activity:
  • treat the host as potentially compromised and follow your incident response process (including credential and key rotation).

KEV deadline

• CISA remediation due date for KEV is 2026-06-22 (apply mitigations by this date if you haven’t already).

Severity is HIGH (CVSS 8.8) and the traffic-light verdict is RED. The mechanism is authenticated command injection in LiteLLM’s MCP stdio test endpoints: the endpoints accept an MCP server configuration and, when using a stdio transport configuration, the system attempts a connection by spawning the supplied command as a subprocess on the host. Users with any valid LiteLLM proxy API key, including low-privilege internal-user keys, can trigger this because there is no role check for these endpoints.

Exploitation status: confirmed active exploitation in the wild, and CVE-2026-42271 is listed in CISA KEV (added 2026-06-08) with a remediation due date of 2026-06-22. Patch: litellm fixed in 1.83.7 and openshift ai fixed in 2.25.8. CWE mappings shown are CWE-77 (OS command injection) and CWE-78 (improper neutralization of special elements used in an OS command). Exploit maturity appears high given KEV/news indicators and sustained press attention; EPSS is reported as very high and rising, but KEV/news confirms exploitation so practical urgency is driven by that fact.