CVE-2026-42271
BerriAI LiteLLM Command Injection Vulnerability
Description
CVE-2026-42271 is a high-severity command injection vulnerability in LiteLLM, a proxy server (AI gateway) that calls LLM APIs in OpenAI format. In versions from 1.74.2 up to before 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration, including the command, args, and env fields of the stdio transport, and spawned the supplied command as a subprocess on the proxy host. The endpoints were gated only by a valid proxy API key with no role check, so any authenticated user, including holders of low-privilege internal-user keys, could run arbitrary commands on the host. CVE-2026-42271 is rated CVSS 8.8 (High), is listed in the CISA KEV catalog, and was patched in version 1.83.7. Operators of LiteLLM should upgrade immediately, as this command injection vulnerability gives low-privileged users remote code execution.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| litellm | litellm | >= 1.74.2, < 1.83.7 |
| redhat | openshift ai | >= 2.25, < 2.25.8; >= 3.3, < 3.3.4; 3.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable(Product, Release Notes)
- https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g(Mitigation, Patch, Vendor Advisory)
- https://access.redhat.com/errata/RHSA-2026:27784(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:28960(Third Party Advisory)
- https://access.redhat.com/errata/RHSA-2026:30056(Third Party Advisory)
- https://access.redhat.com/security/cve/CVE-2026-42271(Third Party Advisory)
- https://bugzilla.redhat.com/show_bug.cgi?id=2467924(Third Party Advisory)
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.json(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2026-42271 is classified under CWE-77 — Command Injection. The MCP preview endpoints take an attacker-supplied command (with args and environment) from the request body and execute it, so externally controlled input directly determines the command that runs on the proxy host.
Learn more: CWE-77 — Command Injection
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2026-42271 also maps to CWE-78 — OS Command Injection. Because the supplied command is spawned as a subprocess on the host with the privileges of the proxy process, the flaw results in arbitrary OS command execution on the LiteLLM server.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2026-42271 carries a CVSS 3.1 base score of 8.8 (High). Attack Vector (Network): the vulnerable endpoints are reachable over the network. Attack Complexity (Low): sending the crafted request requires no special conditions. Privileges Required (Low): any valid proxy API key suffices, including low-privilege internal-user keys, because the endpoints performed no role check. User Interaction (None): no victim action is required. Confidentiality, Integrity and Availability (High): the supplied command runs as a subprocess with the privileges of the proxy process, giving the attacker arbitrary code execution on the LiteLLM host and access to the API keys, models, and data the gateway brokers. With an EPSS score of about 54% (99th percentile) and confirmed active exploitation, the practical risk is full compromise of the AI gateway by any authenticated user.
Exploit Maturity
CISA has added CVE-2026-42271 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The references include the GitHub security advisory GHSA-v4p8-mg3p-g94g and the fixed release v1.83.7-stable, which document the vulnerable endpoints in detail. The EPSS score of about 54% (99th percentile) indicates a very high probability of exploitation. With confirmed exploitation, a detailed public advisory, and a low privilege bar, this vulnerability requires immediate action.
Remediation
- Follow the vendor and CISA required action and upgrade LiteLLM to version 1.83.7 or later, which patches the vulnerable MCP preview endpoints.
- Until you can upgrade, restrict network access to the LiteLLM admin and /mcp-rest endpoints and limit who can obtain proxy API keys.
- Treat all existing proxy API keys as potentially abused: rotate keys and any credentials or secrets accessible from the proxy host, since exploitation requires only a low-privilege key.
- Review logs for requests to POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list with stdio configurations and for unexpected subprocess execution on the host.
- As long-term hardening, enforce role-based authorization on privileged endpoints and never spawn user-supplied commands; isolate any required subprocess execution behind strict allowlists (per the command injection guidance).
Technical Details
The vulnerability combines CWE-77 (Command Injection) and CWE-78 (OS Command Injection): the MCP preview endpoints accept a full stdio transport configuration — command, args, and env — and, when testing the connection, spawn that command as a subprocess on the proxy host. As reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, an authenticated user with any valid proxy API key sends a crafted request to POST /mcp-rest/test/connection or POST /mcp-rest/test/tools/list specifying an attacker-chosen command; because the endpoints performed only API-key validation and no role check, the command executes with the privileges of the proxy process. The absence of an authorization check on a function that runs arbitrary commands is the core of the flaw, which was patched in version 1.83.7.
Frequently Asked Questions
Is CVE-2026-42271 being actively exploited?
Yes. CVE-2026-42271 is listed in CISA's Known Exploited Vulnerabilities catalog, and its EPSS score of about 54% (99th percentile) indicates a very high probability of exploitation. A detailed GitHub security advisory is publicly available.
What products are affected by CVE-2026-42271?
LiteLLM (BerriAI) is affected in versions from 1.74.2 up to before 1.83.7. The issue is fixed in version 1.83.7.
How do I fix CVE-2026-42271?
Upgrade LiteLLM to version 1.83.7 or later. Because exploitation requires only a low-privilege API key, also rotate proxy API keys and any secrets reachable from the host, and review logs for abuse of the MCP test endpoints.
How severe is CVE-2026-42271?
It is rated High with a CVSS 3.1 base score of 8.8. Any authenticated user, even with a low-privilege key, can achieve remote code execution on the LiteLLM host, and the vulnerability is confirmed as actively exploited, so it should be patched immediately.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.