CVE-2026-42271
LiteLLM: Authenticated command execution via MCP stdio test endpoints
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
In plain language
AI Act nowCVE-2026-42271 lets someone with a low-privilege LiteLLM API key run arbitrary commands on the server machine, and it’s already being exploited in the real world—if you run LiteLLM (or OpenShift AI that uses it), you should act immediately.
CVE-2026-42271 is an authenticated command injection in LiteLLM’s MCP stdio test endpoints that allow a user with any valid (low-privilege) proxy API key to trigger OS command execution on the host by submitting malicious MCP server configuration to /mcp-rest/test/connection and /mcp-rest/test/tools/list; it is listed in CISA KEV with active exploitation.
What to do now
- Check whether you run LiteLLM (or OpenShift AI using LiteLLM) and identify the deployed LiteLLM version.
- If your LiteLLM version is between 1.74.2 and 1.83.6 (inclusive), plan to upgrade now to litellm 1.83.7.
- If you are using openshift ai, upgrade now to openshift ai 2.25.8.
- If you cannot upgrade immediately, immediately restrict or rotate the LiteLLM proxy API keys so only trusted admins can access the proxy endpoints, and temporarily block access to the MCP test endpoints from non-admin clients.
- After upgrading, review logs for requests to /mcp-rest/test/connection and /mcp-rest/test/tools/list and investigate any suspicious payloads or process executions.
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:LPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
1 techniqueReferences
- Sangoma Switchvox Vulnerabilities Exploited in the Wilden-us·SecurityWeek· Exploited Sangoma Switchvox rce
- CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Minersen·The Hacker News· Exploited SonicWall SMA 1000 Qilin
- LiteLLM Vulnerability Chain Lets Low-Privilege Users Take Over AI Gateway Serversen·The Hacker News· PoC LiteLLM ai-ml
- Weekly Threat Intelligence: June 8 to June 14, 2026en-us·Daily CyberSecurity (securityonline.info)· Exploited Ivanti Sentry rce
- In Other News: Google Security Layoffs, AudiA6 Takedown, $400 Million Coupang Fineen-us·SecurityWeek· Roundup data-breach
- LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCEen·The Hacker News· Exploited BerriAI LiteLLM ai-ml
- CISA Active Exploit Catalog Expands with Critical Gateway Flawsen-us·Daily CyberSecurity (securityonline.info)· Exploited CISA Known Exploited Vulnerabilities (KEV) catalog entries Qilin
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-42271 and every CVE in our database. Create a free account — no credit card required.
Create Free Account