LiteLLM CVE-2026-42271: CISA KEV Alert for Active Command Injection Exploit

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a high-severity command injection flaw in BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog on Monday. The vulnerability, tracked as CVE-2026-42271, carries a CVSS score of 8.7 and allows authenticated users to execute arbitrary commands on the host. When chained with a Starlette authentication bypass, the combined exploit achieves unauthenticated remote code execution with a critical CVSS score of 10.0.

What Happened: LiteLLM Command Injection Added to CISA KEV Catalog

BerriAI disclosed CVE-2026-42271 in early June 2026. The flaw resides in two LiteLLM endpoints used to preview MCP servers before saving them: POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list. These endpoints accepted a full server configuration in the request body, including command, args, and environment fields used by the stdio transport.

When called with a stdio configuration, the endpoints spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. Consequently, any authenticated user with a valid proxy API key could execute arbitrary commands on the underlying system. This included privileged internal-user keys.

CISA confirmed active exploitation in the wild on June 8, 2026. Federal agencies must patch or mitigate the issue by June 22, 2026, under Binding Operational Directive 22-01. There is currently no public information on the identity of the threat actors, the scale of exploitation, or whether the chained exploit is being used in the observed attacks.

Technical Details of the LiteLLM Vulnerability

CVE-2026-42271 is a command injection vulnerability in the LiteLLM Python package, versions 1.74.2 and later. The affected endpoints were secured only by a valid proxy API key, with no additional role checks. This architectural gap allowed low-privilege authenticated users to pass arbitrary commands through the MCP server test interface.

The attack flow is straightforward. An attacker sends a crafted POST request to one of the two test endpoints with a stdio configuration that includes a malicious command. LiteLLM executes the command on the proxy host, granting the attacker shell access under the proxy process account.

The maintainers patched the flaw in version 1.83.7. Both test endpoints now require the PROXY_ADMIN role, bringing them in line with the save endpoint. Administrators should upgrade immediately and verify that no unauthorized commands have been executed in their environments.

Chained Exploit: Starlette BadHost Authentication Bypass

Last week, Horizon3.ai disclosed that CVE-2026-42271 can be chained with CVE-2026-48710, a host header validation bypass in Starlette versions 1.0.0 and earlier. The flaw, nicknamed BadHost, allows an attacker to bypass authentication entirely in LiteLLM deployments that include a vulnerable Starlette dependency.

When combined, the two vulnerabilities transform an authenticated command injection into an unauthenticated remote code execution scenario. Horizon3.ai assigned the chained exploit a combined CVSS score of 10.0, making it critical. A successful attack could allow threat actors to run arbitrary commands on the LiteLLM host, access model provider credentials, exfiltrate API keys and secrets stored by the proxy, and move laterally into connected AI infrastructure.

Business and Operational Impact

LiteLLM is a widely deployed open-source AI gateway and Python SDK that proxies requests to multiple large language model providers. Organizations use it to manage API keys, enforce rate limits, and standardize access across AI workloads. A compromise of the LiteLLM host has cascading consequences.

• Credential exposure: Attackers can extract model provider API keys and secrets stored by the proxy, leading to unauthorized AI resource consumption and data access.
• Lateral movement: Compromised LiteLLM hosts can serve as pivot points into connected AI infrastructure, data pipelines, and downstream systems.
• Service disruption: Malicious commands can crash the proxy, corrupt configurations, or delete critical AI gateway data.
• Compliance risk: Unauthorized command execution on production hosts may trigger breach notification requirements under frameworks such as GDPR, HIPAA, and PCI DSS.
• Supply chain exposure: Organizations that embed LiteLLM into customer-facing platforms risk passing the compromise to downstream users.

This is not LiteLLM’s first brush with active exploitation. In April 2026, a critical SQL injection flaw in LiteLLM (CVE-2026-42208, CVSS 9.3) was exploited in the wild within 36 hours of disclosure. The repeated targeting of AI infrastructure underscores the growing interest threat actors have in compromising LLM gateways.

Mitigation and Recommendations

Organizations running LiteLLM should treat this as a high-priority patching event. The following actions reduce risk and limit exposure.

Immediate Actions for Defenders

1. Upgrade LiteLLM to version 1.83.7 or later. This release restricts the test endpoints to PROXY_ADMIN users.
2. Upgrade Starlette to version 1.0.1 or later. This closes the BadHost authentication bypass used in the chained exploit.
3. Block the test endpoints at the reverse proxy or API gateway. Deny POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list if immediate patching is not possible.
4. Restrict network access to trusted segments. Limit LiteLLM admin interfaces to internal networks or VPN-only access.
5. Rotate credentials stored by the proxy. Assume compromise and refresh API keys, secrets, and internal-user tokens.
6. Review logs for anomalous activity. Look for unusual Host header values, subprocess execution events, and unauthorized POST requests to the MCP test endpoints.

Long-Term Hardening

• Remove LiteLLM hosts from domain membership where possible to limit lateral movement paths.
• Implement network segmentation between AI gateways and sensitive data stores.
• Monitor for new CVEs in AI infrastructure components and enforce rapid patch cycles.
• Conduct threat modeling on AI supply chain dependencies, including open-source gateways and middleware.

Bottom line: CVE-2026-42271 is actively exploited and easy to weaponize. When chained with the Starlette BadHost bypass, it becomes an unauthenticated critical RCE. Patch LiteLLM and Starlette now, rotate credentials, and review logs for signs of compromise.

Incident Summary

CVE ID / Incident:	CVE-2026-42271 (LiteLLM) and CVE-2026-48710 (Starlette)
Affected Systems:	BerriAI LiteLLM Python package >= 1.74.2; Starlette <= 1.0.0
Disclosure Date:	June 2026; CISA KEV addition: June 8, 2026
Patch Status:	LiteLLM 1.83.7 and Starlette 1.0.1 available
CVSS Score:	8.7 (CVE-2026-42271); 10.0 chained with CVE-2026-48710
CISA Due Date:	June 22, 2026 (federal agencies)

References

1. The Hacker News, “LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE,” June 9, 2026, https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html
2. BerriAI, “GHSA-v4p8-mg3p-g94g: LiteLLM MCP Test Endpoints Command Injection,” June 2026, https://github.com/BerriAI/litellm/security/advisories/GHSA-v4p8-mg3p-g94g
3. CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog,” June 8, 2026, https://www.cisa.gov/news-events/alerts/2026/06/08/cisa-adds-two-known-exploited-vulnerabilities-catalog
4. CISA Known Exploited Vulnerabilities Catalog, “CVE-2026-42271,” accessed June 9, 2026, https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. Horizon3.ai, “CVE-2026-42271 Chained with CVE-2026-48710,” June 2026, https://horizon3.ai/attack-research/vulnerabilities/cve-2026-42271-chained-with-cve-2026-48710/
6. OSTIF, “Disclosing the BadHost Vulnerability in Starlette,” May 2026, https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/
7. NIST NVD, “CVE-2026-11645,” accessed June 9, 2026, https://nvd.nist.gov/vuln/detail/CVE-2026-11645