CVE-2026-42271 Details
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
A vulnerability in LiteLLM versions 1.74.2 prior to 1.83.7 allows authenticated users to execute arbitrary commands on the host machine. This issue arises from two MCP test endpoints, 'POST /mcp-rest/test/connection' and 'POST /mcp-rest/test/tools/list', which accepted full server configurations including command execution details. When these endpoints were used with a standard input/output configuration, they executed the specified commands as subprocesses on the proxy host, using the privileges of the proxy process. The vulnerability was accessible to any user with a valid proxy API key, including those with low-privilege internal-user keys.
Users can upgrade to LiteLLM version 1.83.7 or later, where this vulnerability has been patched. If an immediate upgrade is not possible, the vulnerable endpoints can be blocked at the reverse proxy or API gateway.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:27784 | redhat-SADP | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:28960 | redhat-SADP | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2026:30056 | redhat-SADP | Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2026-42271 | redhat-SADP | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2467924 | redhat-SADP | Third Party Advisory |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.json | redhat-SADP | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271 | CISA-ADP | US Government Resource |
| https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable | [email protected] | ProductRelease Notes |
| https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g | [email protected] | MitigationPatchVendor Advisory |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| BerriAI LiteLLM Command Injection Vulnerability | Jun 8, 2026 | Jun 22, 2026 | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | redhat-SADP |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| litellm litellm | >= 1.74.2, < 1.83.7 |
CPE
Remediation
| |
| redhat openshift ai | >= 2.25, < 2.25.8 >= 3.3, < 3.3.4 3.4 |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | Modified Analysis | [email protected] |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | Modified Analysis | [email protected] |
| Jun 8, 2026 | CVE CISA KEV Update | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | New CVE Received | [email protected] |