CVE-2026-42271

Confirmed PUBLISHED

LiteLLM: Authenticated command execution via MCP stdio test endpoints

BerriAI · litellm

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

8.7 High EPSS 80.2%

At a Glance

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

cisa nuclei_scanner

CVE Published: May 08, 2026
Exploitation Reported: Jun 08, 2026
CVSS: 8.7 High
EPSS: 80.2%

Remote Low complexity No user interaction

Affected Versions

Vendor	Product	Version	Status
Red Hat	Red Hat OpenShift AI 2.25 rhoai/odh-llama-stack-core-rhel9	1781826406 to < *	Unaffected
Red Hat	Red Hat OpenShift AI 3.3 rhoai/odh-llama-stack-core-rhel9	1782310008 to < *	Unaffected
Red Hat	Red Hat OpenShift AI 3.4 rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9	1781622627 to < *	Unaffected
Red Hat	Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9	All versions (default: unaffected)	Unaffected
Red Hat	Red Hat Ansible Automation Platform 2 ansible-automation-platform-26/lightspeed-chatbot-rhel9	All versions (default: unaffected)	Unaffected
Red Hat	Red Hat Ansible Automation Platform 2 ansible-automation-platform-27/lightspeed-chatbot-rhel9	All versions (default: unaffected)	Unaffected
Red Hat	Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-rhel9	All versions (default: unaffected)	Unaffected
BerriAI	litellm	>= 1.74.2, < 1.83.7	Affected

CVE References

https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g github.com · CVE Record https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p...
https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable github.com · CVE Record https://github.com/BerriAI/litellm/releases/tag/v1.83.7-stable

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2026-06-08 18:00 UTC
CVE	2026-06-08 18:10 UTC
All CISA Advisories	2026-06-08 20:20 UTC
TheHackerNews	2026-06-09 07:20 UTC
The Shadowserver	2026-07-07 10:15 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42271.yaml	Jun 03, 2026

CVSS Scores

CVSS v4.0 8.7 High

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N

CVSS v3.1 8.8 High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2026-06-08 18:00:47 UTC · CISA

Proof of concept available

Recorded 2026-06-09 08:13:12 UTC · GitHub

Weaknesses (CWE)

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-42271.yaml	Jun 03, 2026

Recent Mentions

LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE

TheHackerNews · Jun 09, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the

CISA Adds Two Known Exploited Vulnerabilities to Catalog

All CISA Advisories · Jun 08, 2026

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-42271 BerriAI LiteLLM Command Injection Vulnerability CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the KEV Catalog as a living list of known Common Vulnerabilities and Exposures (CVEs) that carry significant risk to the federal enterprise. BOD 22-01 requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information. Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

amnsecurity/CVE-2026-42271-LiteLLM-RCE

github · Created 2026-07-07 23:52:20 UTC · 0 stars

CVE-2026-42271 - LiteLLM AI Gateway MCP Command Injection RCE - PoC & Analysis | CVSS 8.8 | AMN SECURITY

HORKimhab/CVE-2026-42271

github · Created 2026-06-09 08:13:12 UTC · 0 stars

CVE-2026-42271 - Draft

learner202649/CVE-2026-42271-PoC

github · Created 2026-05-20 01:12:57 UTC · 0 stars

The code for personally reproducing the corresponding vulnerability

LiteLLM - Command Injection

nuclei · Created Unknown

Timeline

Key exploitation, disclosure, scanner coverage, and KEV attestation events for this CVE.

7 Jul 2026 10:15 UTC 13 days ago

7 Jul 2026 10:15 UTC · 13 days ago

KEV confirmed by The Shadowserver

Exploitation attested by an external source
9 Jun 2026 07:20 UTC about 1 month ago

9 Jun 2026 07:20 UTC · about 1 month ago

KEV confirmed by TheHackerNews

Exploitation attested by an external source
8 Jun 2026 20:20 UTC about 1 month ago

8 Jun 2026 20:20 UTC · about 1 month ago

KEV confirmed by All CISA Advisories

Exploitation attested by an external source
8 Jun 2026 18:10 UTC about 1 month ago

8 Jun 2026 18:10 UTC · about 1 month ago

KEV confirmed by CVE

Exploitation attested by an external source
8 Jun 2026 18:00 UTC about 1 month ago

8 Jun 2026 18:00 UTC · about 1 month ago

Added to CISA KEV

Listed in the CISA Known Exploited Vulnerabilities catalog
3 Jun 2026 04:30 UTC about 2 months ago

3 Jun 2026 04:30 UTC · about 2 months ago

Nuclei template available

Scanner coverage available
20 May 2026 01:12 UTC 2 months ago

20 May 2026 01:12 UTC · 2 months ago

Public PoC available

Public proof-of-concept code published
8 May 2026 03:35 UTC 2 months ago

8 May 2026 03:35 UTC · 2 months ago

CVE published

Vulnerability disclosed publicly
26 Apr 2026 11:53 UTC 3 months ago

26 Apr 2026 11:53 UTC · 3 months ago

CVE ID reserved

Identifier reserved by the CNA

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2026-42271

{
  "cve_id": "CVE-2026-42271",
  "title": "LiteLLM: Authenticated command execution via MCP stdio test endpoints",
  "affected_vendor": "BerriAI",
  "affected_product": "litellm",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 8.7,
  "epss_score": 0.80188,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2026-42271

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Recent Mentions

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API