CVE-2026-42271 is a command injection vulnerability in LiteLLM, an open-source proxy server (AI Gateway) that exposes large language model APIs in OpenAI-compatible format. The flaw affects versions from 1.74.2 up to but not including 1.83.7 . Two Model Context Protocol (MCP) preview endpoints accept full server configurations, including command , args , and env fields used by the stdio transport. Any authenticated user holding a valid proxy API key can trigger subprocess execution on the proxy host. The endpoints lack role-based authorization, allowing low-privilege internal users to run arbitrary commands with the privileges of the proxy process.
Authenticated attackers with low-privilege API keys can execute arbitrary commands on the LiteLLM proxy host, enabling full host compromise and lateral movement into connected AI infrastructure.
The vulnerability resides in two MCP preview endpoints: POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list . These endpoints allow callers to preview an MCP server configuration before saving it. The request body accepts the full configuration, including transport-specific fields. When the supplied configuration uses the stdio transport, the proxy invokes the configured command with its args and env to establish the connection. This subprocess executes on the proxy host under the proxy process privileges. The endpoints validate only that the request carries a valid proxy API key. No role check restricts use to administrators, so any internal-user token suffices. The flaw is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command .
The root cause is missing authorization combined with unsafe handling of user-controlled process configuration. The endpoints trust authenticated callers to supply the executable path and arguments that the proxy will spawn. There is no allowlist of permitted commands, no administrator role gate, and no sandbox isolating the spawned subprocess from the host.
An attacker authenticates to the LiteLLM proxy using any valid API key, including a low-privilege internal-user key. The attacker sends a crafted POST request to /mcp-rest/test/connection or /mcp-rest/test/tools/list containing a JSON body describing a stdio-transport MCP server. The command field is set to an arbitrary binary on the host, and args and env supply attacker-controlled parameters. The proxy spawns the process, granting the attacker command execution with proxy-process privileges. From this foothold, attackers can access stored model API keys, environment secrets, and any backend services the proxy can reach.
LiteLLM addressed the vulnerability in version 1.83.7 . Release notes and download artifacts are available in the LiteLLM v1.83.7 release . The vendor advisory with full technical detail is published as GitHub Security Advisory GHSA-v4p8-mg3p-g94g .
Disclaimer : This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
