LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-42208 +1 in the same advisory: …42271 | SQL Injection in BerriAI LiteLLM Proxy Exploited in the Wild BerriAI LiteLLM, an open-source proxy server (AI gateway) used to call LLM APIs in OpenAI or native format, contains a SQL injection (CWE-89) in the database query performed during proxy API key checks in versions 1.81.16 through before 1.83.7: the caller-supplied key value was mixed into the query text rather than passed as a parameter. An unauthenticated attacker triggers the flaw by sending a specially crafted Authorization header to any LLM API route (for example POST /chat/completions), reaching the vulnerable query through the proxy's error-handling path. Successful exploitation lets the attacker read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the API keys/credentials it manages; CVSS 4.0 rates it 9.3 (critical). Any organization running an affected LiteLLM proxy version is affected, particularly instances reachable over a network. Exploitation is confirmed in the wild: the flaw was reportedly exploited within 36 hours of disclosure, CISA added it to the Known Exploited Vulnerabilities catalog on 2026-05-08, and EPSS puts the 30-day exploitation probability at 89.4%. Do: Upgrade LiteLLM to version 1.83.7 or later immediately; exploitation began within 36 hours of disclosure, the flaw is in CISA's KEV catalog, and federal agencies must apply mitigations under BOD 22-01. Until patched, restrict network access to the proxy, and review proxy database logs for unexpected queries or unauthorized key usage; if compromise is suspected, rotate the API keys and credentials stored in the proxy database. Also check your exposure to the separately reported LiteLLM issue CVE-2026-42271, which is reported as exploited in the wild and chains to unauthenticated RCE. | 9.3 group max | 89% | KEV |
| largeroughly tens of thousands of self-hosted LiteLLM proxy deployments (exact counts unknown) | |
| CVE-2026-48710 | HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710) Kludex Starlette prior to version 1.0.1 did not validate the HTTP Host request header before using it to reconstruct request.url, an inconsistency classified as HTTP request/response smuggling (CWE-444). Because routing operates on the raw ASGI scope path while request.url is rebuilt from the unvalidated Host header, an attacker can send a malformed Host header so that request.url.path differs from the path the router actually processed. Any middleware or endpoint that enforces security restrictions based on request.url rather than the raw scope path can then be tricked into approving requests that should have been blocked, bypassing those controls. All Starlette deployments below 1.0.1 are affected, both direct users and downstream products that bundle the library, including Red Hat offerings such as Ansible Automation Platform, OpenShift AI, OpenShift Lightspeed, Satellite, AI Inference Server, Migration Toolkit for Applications, and Enterprise Linux AI. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation; related reporting describes attackers deploying reverse shells and crypto miners, and EPSS ranks it in the 98th percentile with a 36.3% probability of exploitation within 30 days. Do: Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112/RFC 3986 grammar and falls back to scope['server'] for malformed values, and apply the corresponding Red Hat updates for each bundled product listed above. Until patched, review middleware and endpoints that enforce security decisions from request.url and validate or pin the Host header at your reverse proxy or load balancer. As a KEV entry, federal agencies must patch per BOD 26-04 timelines based on each asset's internet exposure, and operators of internet-facing AI infrastructure should verify their Starlette/FastAPI dependency versions. | 6.5 | 36% | KEV PoC ×3 |
| mass>1M library deployments (Starlette is the core ASGI dependency beneath FastAPI and much of the Python AI-serving stack, with hundreds of millions of monthly… |
Full article560 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 09, 2026Vulnerability / Artificial Intelligence
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerability, tracked as CVE-2026-42271 (CVSS score: 8.7), is a command injection vulnerability that could allow any authenticated user to run arbitrary commands on the host.
It affects the following version of the LiteLLM Python package -
- >= 1.74.2
- < 1.83.7
"Two endpoints used to preview an MCP server before saving it - POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list - accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport," according to a description of the flaw shared by BerriAI.
"When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process."
The maintainers of the open-source AI gateway and Python SDK said the endpoints were secured only by means of a valid proxy API key, as a result of which any authenticated user, including privileged internal-user keys, could execute arbitrary commands on a susceptible system.
As part of the patches released in version 1.83.7, both the test endpoints now require the PROXY_ADMIN role, making it consistent with the save endpoint.
LiteLLM Unauthenticated Remote Code Execution via Starlette Host Header Validation Bypass
Last week, Horizon3.ai said it chained CVE-2026-42271 with CVE-2026-48710 (CVSS score: 6.5), a "BadHost" host header validation bypass vulnerability affecting Starlette, a lightweight Asynchronous Server Gateway Interface (ASGI) framework, to completely sidestep authentication and achieve remote code execution against vulnerable LiteLLM deployments.
"CVE-2026-48710 can be used to bypass the authentication mechanism entirely in LiteLLM deployments whose dependency tree includes Starlette versions ≤ 1.0.0," Horizon3.ai said. "This transforms the vulnerability into unauthenticated remote code execution with no credentials required."
Successful weaponization of the exploit chain could allow attackers to run arbitrary commands on the LiteLLM host, access model provider credentials, siphon API keys and secrets stored by the proxy, move laterally into connected AI infrastructure, and even compromise downstream systems integrated with the gateway.
Per Horizon3.ai, the chained vulnerability has a combined CVSS score of 10.0, making it critical in nature.
There is currently no information on how CVE-2026-42271 is being exploited, the identity of the threat actor(s) behind the efforts, who are targeted, how widespread these attacks are, or if the activity has successfully compromised any instances. It's also unclear if the attacks observed in the wild are leveraging the exploit chain.
Users are advised to update LiteLLM to version 1.83.7 or later and Starlette to version 1.0.1 or later. If immediate patching is not an option, the following mitigations are recommended -
- Block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the reverse proxy or API gateway.
- Restrict network access to trusted segments.
- Rotate credentials stored by the proxy.
- Review logs for unusual Host header activity and subprocess execution events.
The development comes a little over a month after a critical SQL injection flaw in LiteLLM (CVE-2026-42208, CVSS score: 9.3) came under active exploitation within 36 hours of the bug becoming public knowledge.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.html