cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Actively Exploited LiteLLM Flaw Can Be Chained to Unauthenticated RCE

· Original article ↗

Summary

CISA added LiteLLM command-injection flaw CVE-2026-42271 to its KEV catalog. Horizon3.ai demonstrated a Starlette flaw chain that can enable unauthenticated RCE; it is unknown whether observed attacks use the chain.

Key points

  • CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation; the article gives no details on the attacks, targets, or actor.
  • The command-injection flaw affects LiteLLM versions 1.74.2 through 1.83.6 and lets an authenticated user run commands on the proxy host.
  • The MCP preview endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list accepted attacker-supplied stdio configuration that could spawn commands.
  • LiteLLM 1.83.7 requires the PROXY_ADMIN role for both endpoints.
  • Horizon3.ai demonstrated chaining CVE-2026-42271 with Starlette CVE-2026-48710 to bypass authentication and achieve unauthenticated RCE in affected deployments; it is unclear whether observed exploitation uses the chain.
  • The article recommends updating LiteLLM to 1.83.7 or later and Starlette to 1.0.1 or later. Interim steps include blocking the endpoints, restricting network access, rotating proxy-stored credentials, and reviewing logs.

Article Details

Vulnerability Types
  • Command injection
  • Host header validation bypass
Severity
High for CVE-2026-42271 (CVSS 8.7); the chained vulnerabilities have a combined CVSS score of 10.0.
Affected Versions
  • LiteLLM 1.74.2 through 1.83.6
  • Starlette versions ≤ 1.0.0
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the reverse proxy or API gateway.
  • Restrict network access to trusted segments.

MITRE ATT&CK

T1059 · Command and Scripting InterpreterThe LiteLLM test endpoints could spawn a command supplied in the stdio configuration as a subprocess on the proxy host.

CVE

CVE-2026-42208The development comes a little over a month after a critical SQL injection flaw in LiteLLM (CVE-2026-42208, CVSS score: 9.3) came under active exploitation within 36 hours of the bug becoming public knowledge.CVE-2026-42271CISA has added CVE-2026-42271, a high-severity command injection flaw in BerriAI LiteLLM, to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation.CVE-2026-48710Horizon3.ai also showed that CVE-2026-42271 can be chained with CVE-2026-48710 in Starlette to bypass authentication and achieve unauthenticated remote code execution against vulnerable LiteLLM deployments.

Vendors

BerriAICISA has added CVE-2026-42271, a high-severity command injection flaw in BerriAI LiteLLM, to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation.

Products

LiteLLMCISA has added CVE-2026-42271, a high-severity command injection flaw in BerriAI LiteLLM, to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation.StarletteHorizon3.ai also showed that CVE-2026-42271 can be chained with CVE-2026-48710 in Starlette to bypass authentication and achieve unauthenticated remote code execution against vulnerable LiteLLM deployments.

Related Articles