Skip to content
Fencer Vulns
high 8.8

CVE-2026-42271 kev in the critical feed json

LiteLLM: Authenticated command execution via MCP stdio test endpoints

published 2026-04-25 6 mo ago modified 2026-10-26 13 d ago also GHSA-v4p8-mg3p-g94g , PYSEC-2026-2599 , EUVD-2026-28507

cvss
8.8
version 3.1, CNA
cisa kev
Exploited
added 2026-06-08
epss
91.4%
EPSS 91.4% chance of exploitation in 30 days, percentile 99.8%
public exploits
1
Metasploit, plus a Nuclei check

Summary

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  • pypi litellm 1.83.7
  • Red Hat Red Hat OpenShift AI 2.25 1781826406
  • Red Hat Red Hat OpenShift AI 3.3 1782310008
  • Red Hat Red Hat OpenShift AI 3.4 1781622627

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42271 updated cvss 8.8

litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints

  • Red Hat OpenShift AI 2.25 rhoai/odh-llama-stack-core-rhel9 1781826406
    fixed: vendor fix RHSA-2026:28960
  • Red Hat OpenShift AI 3.3 rhoai/odh-llama-stack-core-rhel9 1782310008
    fixed: vendor fix RHSA-2026:30056
  • Red Hat OpenShift AI 3.4 rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 1781622627
    fixed: vendor fix RHSA-2026:27784
  • Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/lightspeed-chatbot-rhel9, ansible-automation-platform-27/lightspeed-chatbot-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1782131177, rhoai/odh-operator-bundle 1782131953 Red Hat OpenShift AI 3.3 rhoai/odh-rhel9-operator 1782332088, rhoai/odh-operator-bundle 1782332801 Red Hat OpenShift AI 3.4 rhoai/odh-rhel9-operator 1781681524, rhoai/odh-operator-bundle 1781682120
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/litellm_mcp_test_cmd_injection)
  2. Published
  3. CISA SSVC: exploitation active
  4. Added to CISA KEV
  5. CISA patch deadline

Known exploited

Added
5 mo ago
Patch by
2026-06-22 (4 mo ago)
Ransomware
Not known
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product
BerriAI, LiteLLM
CISA name
BerriAI LiteLLM Command Injection Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
6 mo ago

Exploit prediction

91.44% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
OSV 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi litellm
>=1.74.2, <1.83.7
1.83.7

Affected products

  • BerriAI litellm
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Exploit Intelligence
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.