LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added a significant vulnerability affecting the BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability, identified as CVE-2026-42271, has a high CVSS score of 8.7, indicating its severity. It is a command injection flaw that allows authenticated users to execute arbitrary commands on the host system. The affected versions of the LiteLLM Python package are those from version 1.74.2 up to, but not including, version 1.83.7. The vulnerability arises from two endpoints used to preview an MCP server configuration before saving it. These endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, accepted a full server configuration in the request body, which included command, args, and env fields used by the stdio transport. When a stdio configuration was used, these endpoints attempted to connect, spawning the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The maintainers of the LiteLLM Python SDK and AI gateway noted that these endpoints were only secured by a valid proxy API key. This meant that any authenticated user, including those with privileged internal-user keys, could exploit the vulnerability to execute arbitrary commands on a vulnerable system. To address this issue, patches were released in version 1.83.7, requiring the PROXY_ADMIN role for the test endpoints, aligning them with the save endpoint. In addition to CVE-2026-42271, Horizon3.ai discovered that this vulnerability could be combined with another flaw, CVE-2026-48710, which affects the Starlette framework. This "BadHost" host header validation bypass vulnerability allows attackers to completely bypass authentication in LiteLLM deployments that use Starlette versions 1.0.0 or earlier. This combination transforms the vulnerability into an unauthenticated remote code execution, significantly increasing the risk. The successful exploitation of this vulnerability chain could enable attackers to execute arbitrary commands on the LiteLLM host, access sensitive credentials, siphon API keys and secrets, and potentially compromise connected AI infrastructure and downstream systems. Horizon3.ai assessed the combined vulnerability with a critical CVSS score of 10.0, highlighting the urgency of addressing this security issue. Despite the severity of these vulnerabilities, there is currently limited information about how they are being exploited, the identity of the threat actors, or the scope of the attacks. It is also unclear whether the observed attacks have successfully compromised any instances or if they leverage the exploit chain. Users are strongly advised to update LiteLLM to version 1.83.7 or later and Starlette to version 1.0.1 or later to mitigate these risks. For users unable to immediately apply patches, several mitigations are recommended. These include blocking the vulnerable endpoints at the reverse proxy or API gateway, restricting network access to trusted segments, rotating credentials stored by the proxy, and reviewing logs for unusual Host header activity and subprocess execution events. These steps can help reduce the risk of exploitation until a patch can be applied. This development follows closely after another critical vulnerability in LiteLLM, a SQL injection flaw identified as CVE-2026-42208, which was actively exploited shortly after becoming public. The rapid exploitation of these vulnerabilities underscores the importance of timely updates and vigilant security practices.