CVE-2026-42271: BerriAI LiteLLM Command Injection Vulnerability
Vulnerability summary
CVE-2026-42271 is a high (CVSS 8.8) Command Injection vulnerability in BerriAI LiteLLM. It is known to be exploited: CISA lists it, first on 08-06-2026. EPSS estimates a 92.57% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 08-05-2026PublishedVulnerability first disclosed.
- 08-06-2026Added to CISA KEVBerriAI LiteLLM Command Injection Vulnerability
- 22-06-2026CISA remediation dueApply mitigations per vendor instructions.
- 15-07-2026Last modifiedVulnerability information updated.
Description
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.
CVSS metrics
8 scores · 5 sources · 2 versions- OSV · PypiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N
- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
92.57%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
+8.98 pp
From 83.59% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 08-06-2026
- Federal due date
- 22-06-2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. github.com/BerriAI/litellm/releases/tag/v1.83.7-stable nvd.nist.gov/vuln/detail/CVE-2026-42271
Public exploits
1 foundBerriAI LiteLLM Proxy MCP Test Endpoint Command Execution
exploit/multi/http/litellm_mcp_test_cmd_injection
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Affected systems
Chainguard2 products
- airflow-3< 3.2.2-r7
- litellm< 1.83.10.0-r0
Berriai1 product
- litellm≥ 1.74.2, < 1.83.7
Litellm1 product
- litellm≥ 1.74.2, < 1.83.7
PyPI1 product
- litellm≥ 1.74.2, < 1.83.7
Redhat1 product
- openshift_ai≥ 2.25, < 2.25.8 | ≥ 3.3, < 3.3.4 | 3.4
Wolfi1 product
- airflow-3< 3.2.2-r7
6 vendors · 7 products
References
14 links- github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94gX Refsource CONFIRMWEBAdvisoryMitigationPatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42271Government ResourceWEBUS Government Resource
- access.redhat.com/security/cve/CVE-2026-42271VDB EntryX Refsource REDHATAdvisoryThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=2467924Issue TrackingX Refsource REDHATREPORTThird Party Advisory
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.jsonX Sadp Csaf VexWEBThird Party Advisory
- access.redhat.com/errata/RHSA-2026:28960Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:30056Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- access.redhat.com/errata/RHSA-2026:27784Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
Show all 14 references
- github.com/BerriAI/litellmPACKAGE
- pypi.org/project/litellmPACKAGE