CVE-2026-42271: LiteLLM MCP test endpoints allow authenticated OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityThe flaw allows authenticated remote command execution on the AI gateway host, is listed in CISA KEV with a near-term due date, and has an EPSS probability above 0.83.

What it is

LiteLLM versions 1.74.2 through before 1.83.7 expose two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) that accept a full server configuration, including the command, args and env fields of the stdio transport. When given a stdio configuration, the endpoints spawn the supplied command as a subprocess on the proxy host with the proxy process's privileges. The endpoints were gated only by a valid proxy API key with no role check, so any authenticated user could execute arbitrary commands.

Impact

An attacker with any valid proxy API key, including a low-privilege internal-user key, gains arbitrary command execution on the LiteLLM proxy host under the proxy process's privileges. This enables host compromise, data theft and lateral movement from the AI gateway.

Attack surface

Reachable over the network via HTTP POST to the two MCP test endpoints; only a valid proxy API key is required, with no role check and no user interaction. The CVSS vector confirms network attack, low privileges and no UI.

Exploitation

CVE-2026-42271 was added to CISA KEV on 2026-06-08 with a 2026-06-22 remediation due date, and EPSS gives a 30-day probability of 0.83594 (99.669th percentile). No ransomware campaign use is documented in the record.

What to do

• Upgrade LiteLLM to version 1.83.7 or later, which contains the patch.
• Apply the Red Hat errata (RHSA-2026:27784, RHSA-2026:28960, RHSA-2026:30056) for OpenShift AI deployments.
• If immediate patching is not possible, restrict network access to the MCP test endpoints and rotate or revoke low-privilege proxy API keys.
• Enforce role-based authorization on administrative and MCP preview endpoints so internal-user keys cannot reach them.
• Follow CISA KEV required action: apply vendor mitigations, follow BOD 22-01 guidance for cloud services, or discontinue use of the product.

Detection

• Monitor proxy and application logs for POST requests to /mcp-rest/test/connection and /mcp-rest/test/tools/list, especially with stdio configurations containing command, args or env fields.
• Alert on unexpected child processes spawned by the LiteLLM proxy process, particularly shells or interpreters.
• Audit proxy API key usage for low-privilege internal-user keys calling MCP test endpoints.
• Review host process telemetry for command execution originating from the LiteLLM service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.