Back Feeds2.Feedburner

LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)

Feeds2.Feedburner •Zeljka Zorz • June 9, 2026

A command injection vulnerability (CVE-2026-42271) in BerryAI’s LiteLLM open-source AI gateway is being exploited by attackers, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed by adding the flaw to its Known Exploited Vulnerabilities catalog on Monday. CVE-2026-42271 LiteLLM is an open-source library that provides a unified interface for calling many different large language model APIs using a single (OpenAI) format. It’s used by both developers and enterprises, to avoid vendor lock-in, centrally manage … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Unauthenticated RCE Vulnerability in LiteLLM Exploited in the Wild A critical command injection vulnerability, CVE-2026-42271, in LiteLLM, an open-source AI gateway, allows unauthenticated remote code execution (RCE) when chained with CVE-2026-48710, a Host header validation bypass in Starlette. This exploit affects LiteLLM versions 1.74.2 to 1.83.6, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) adding it to its Known Exploited Vulnerabilities catalog on 2026-06-08. Attackers can execute arbitrary commands on the host system without authentication, posing severe risks to AI infrastructures. The vulnerability was first disclosed on 2026-05-08, with public proof-of-concept code available since 2026-05-20. The attack surface is particularly attractive to cybercriminals targeting sensitive model provider credentials. Organizations are urged to upgrade to LiteLLM version 1.83.7 and Starlette version 1.0.1 to mitigate the risk. 9 sources 86

Extracted Entities

LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Vulnerabilities (1)