LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
08:26 · June 9, 2026 · Hacker News AI Section
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the
Summary
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-42271, a command-injection flaw in the open-source LiteLLM AI gateway and Python SDK, to its Known Exploited Vulnerabilities catalog. The vulnerability carries a CVSS score of 8.7 and stems from two preview endpoints—POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list—that accepted an arbitrary server configuration, including the command, arguments, and environment variables used by the stdio transport. When invoked, these endpoints spawned the supplied command as a subprocess on the proxy host, running with the privileges of the LiteLLM process.
Access to the endpoints was gated solely by a valid proxy API key, allowing any authenticated user, including holders of internal privileged keys, to execute arbitrary commands. BerriAI addressed the issue in version 1.83.7 by requiring the PROXY_ADMIN role for the test endpoints, aligning their access controls with those of the corresponding save endpoint.
Researchers at Horizon3.ai subsequently demonstrated that the flaw can be chained with CVE-2026-48710, a host-header validation bypass in Starlette versions up to 1.0.0, to bypass authentication entirely. The combined attack path yields unauthenticated remote code execution with a composite CVSS score of 10.0. Successful exploitation could expose model-provider credentials, API keys stored by the proxy, and enable lateral movement into connected AI infrastructure.
CISA’s listing confirms active exploitation in the wild, although details on the techniques, threat actors, and targeted organizations remain limited. Administrators are advised to upgrade LiteLLM to 1.83.7 or later and Starlette to 1.0.1 or later; the incident follows closely after another LiteLLM vulnerability, CVE-2026-42208, that was exploited within days of disclosure.
Why it matters
This article is highly relevant for security professionals managing AI infrastructure, as LiteLLM is a widely used tool for routing LLM API calls. Dutch enterprises utilizing LiteLLM must patch immediately to prevent remote code execution and secure their AI deployments against active threats.
