LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE

Summary: CISA added CVE-2026-42271, a command injection flaw in BerriAI LiteLLM with a CVSS score of 8.7, to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation. The flaw let any authenticated user run arbitrary commands on the proxy host through the POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints, which spawned supplied stdio commands as subprocesses and were secured only by a valid proxy API key; version 1.83.7 now requires the PROXY_ADMIN role for both endpoints.
What's compelling: Horizon3.ai chained CVE-2026-42271 with the Starlette 'BadHost' flaw CVE-2026-48710 to bypass authentication entirely, producing unauthenticated remote code execution with a combined CVSS score of 10.0 - and a successful exploit can reach model provider credentials, stored API keys and secrets, and connected AI infrastructure.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-42208 CVE-2026-42271 CVE-2026-48710
Related: CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners Cyber Risks ·
CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability Known Exploited Vulnerabilities · Sep 02, 2026
CVE-2026-42271: Berri AI LiteLLM Command Injection Vulnerability Known Exploited Vulnerabilities · Jun 08, 2026