CVE-2026-42271 is a command injection vulnerability in LiteLLM’s MCP server test endpoints that was originally disclosed as requiring authentication. Horizon3.ai researchers confirmed that when chained with CVE-2026-48710, a Starlette “BadHost” Host Header validation bypass vulnerability, the authentication requirement can be bypassed entirely. The result is unauthenticated remote code execution against vulnerable LiteLLM deployments, allowing attackers to execute commands as the LiteLLM proxy process. Affected LiteLLM versions include 1.74.2 through 1.83.6.
CVE-2026-42271 affects the following LiteLLM MCP server endpoints:
These endpoints accept a complete server configuration, including command, arguments, and environment variables used by the stdio transport. When invoked, LiteLLM spawns the supplied command as a subprocess on the proxy host. The issue was originally considered authenticated because access was gated by a valid proxy API key.
Horizon3.ai researchers validated that CVE-2026-48710 can be used to bypass the authentication mechanism entirely in LiteLLM deployments whose dependency tree includes Starlette versions ≤ 1.0.0. This transforms the vulnerability into unauthenticated remote code execution with no credentials required.
Successful exploitation allows attackers to:
The chained vulnerability has been assessed as CVSS 10.0 Critical.organizations relying on self-hosted Gitea environments.
A NodeZero Rapid Response test has been developed to safely validate whether this chained authentication bypass and command injection vulnerability can be exploited in your environment. The test executes real attack techniques without causing damage, giving teams immediate clarity on exposure.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
