LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-42271 | Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild CVE-2026-42271 is a command injection (CWE-77/CWE-78) in BerriAI LiteLLM's proxy server, a widely used AI gateway for calling LLM APIs. Two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) accept a full stdio server configuration, including command, args, and env fields, and spawn the supplied command as a subprocess on the proxy host; the endpoints are gated only by any valid proxy API key with no role check, so even low-privilege internal-user keys can trigger it. An attacker with any authenticated key gains arbitrary command execution with the privileges of the proxy process, and reporting indicates attackers are chaining the flaw into broader takeover of AI gateway servers, including reverse shells and crypto miners, in some cases via weak or default keys such as the example 'sk-1234' admin key. Any organization running LiteLLM versions 1.74.2 through before 1.83.7, including LiteLLM distributed with Red Hat OpenShift AI, is affected. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-08 and is under active attack, with a very high EPSS of 83.6% for exploitation within 30 days. Do: Upgrade LiteLLM to version 1.83.7 or later immediately (federal agencies must act per CISA KEV/BOD 22-01), and apply Red Hat's advisory updates if running OpenShift AI. Until patched, restrict or rotate proxy API keys — especially low-privilege internal-user and any default/example keys such as 'sk-1234' — and limit network access to the /mcp-rest/test/* endpoints. Review proxy hosts for indicators of compromise such as unexpected spawned subprocesses, reverse shells, or crypto miners, and rotate credentials that may have been captured via compromised environments. | 8.7 | 84% | KEV |
| moderatelikely on the order of thousands of internet-exposed LiteLLM gateway deployments (est. 1k-10k exposed instances), plus private/internal installs of unknown… | |
| CVE-2026-48710 | HTTP Request Smuggling in Kludex Starlette (CVE-2026-48710) Kludex Starlette prior to version 1.0.1 did not validate the HTTP Host request header before using it to reconstruct request.url, an inconsistency classified as HTTP request/response smuggling (CWE-444). Because routing operates on the raw ASGI scope path while request.url is rebuilt from the unvalidated Host header, an attacker can send a malformed Host header so that request.url.path differs from the path the router actually processed. Any middleware or endpoint that enforces security restrictions based on request.url rather than the raw scope path can then be tricked into approving requests that should have been blocked, bypassing those controls. All Starlette deployments below 1.0.1 are affected, both direct users and downstream products that bundle the library, including Red Hat offerings such as Ansible Automation Platform, OpenShift AI, OpenShift Lightspeed, Satellite, AI Inference Server, Migration Toolkit for Applications, and Enterprise Linux AI. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation; related reporting describes attackers deploying reverse shells and crypto miners, and EPSS ranks it in the 98th percentile with a 36.3% probability of exploitation within 30 days. Do: Upgrade Starlette to 1.0.1 or later, which validates the Host header against RFC 9112/RFC 3986 grammar and falls back to scope['server'] for malformed values, and apply the corresponding Red Hat updates for each bundled product listed above. Until patched, review middleware and endpoints that enforce security decisions from request.url and validate or pin the Host header at your reverse proxy or load balancer. As a KEV entry, federal agencies must patch per BOD 26-04 timelines based on each asset's internet exposure, and operators of internet-facing AI infrastructure should verify their Starlette/FastAPI dependency versions. | 6.5 | 36% | KEV PoC ×3 |
| mass>1M library deployments (Starlette is the core ASGI dependency beneath FastAPI and much of the Python AI-serving stack, with hundreds of millions of monthly… |
Full article573 words · extracted from helpnetsecurity.com · click to collapse
A command injection vulnerability (CVE-2026-42271) in BerryAI’s LiteLLM open-source AI gateway is being exploited by attackers, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed by adding the flaw to its Known Exploited Vulnerabilities catalog on Monday.
About CVE-2026-42271
LiteLLM is an open-source library that provides a unified interface for calling many different large language model APIs using a single (OpenAI) format.
It’s used by both developers and enterprises, to avoid vendor lock-in, centrally manage API keys and costs, and route or load-balance AI traffic without rewriting integration code.
LiteLLM can be used either by directly integrating the Python SDK (software development kit) in applications, or can be run as a standalone AI gateway / proxy server that teams and organizations can point their apps at.
CVE-2026-42271, which was publicly disclosed in April 2026, arises from improper neutralization of special elements used in a command and OS command.
“Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio [Standard Input/Output] transport,” the company’s GitHub advisory explains.
“When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host.”
“BadHost” vulnerability lowers the bar for LiteLLM attackers
It was initially believed that attackers needed a valid proxy API key to successfully exploit CVE-2026-42271.
However, Horizon3.ai researchers confirmed that this requirement can be eliminated if attackers can exploit CVE-2026-48710, an authentication bypass vulnerability dubbed BadHost, which affects Starlette – a lightweight Python web framework that LiteLLM uses to handle HTTP requests.
“Successful exploitation allows attackers to: execute arbitrary commands on the LiteLLM host, access model provider credentials, steal API keys and secrets stored by the proxy, move laterally into connected AI infrastructure, [and] compromise downstream systems integrated with the gateway,” they noted, and shared a list of indicators and activity that may point to compromise.
CVE-2026-48710 has been fixed in Starlette v1.0.1.
LiteLLM is a recurring target
A fix for CVE-2026-42271 has been added to v1.83.7 of the LiteLLM library, and includes additional authorization controls (allowing only users with the PROXY_ADMIN role to call the test endpoints) and updated Starlette dependencies.
Individuals and organizations using LiteLLM have been advised to upgrade to the fixed version or, if that’s not possible, to block access to the above-mentioned MCP test endpoints, restrict network access to trusted segments, and rotate credentials stored by the proxy.
Unfortunately, no details are available about the attack(s) in which CVE-2026-42271 is being leveraged, and no confirmation that attackers are exploiting CVE-2026-48710 at the same time. CISA has directed US federal civilian agencies to address CVE-2026-42271 by June 22, 2026.
This is the second time in a month that a publicly disclosed LiteLLM flaw has been weaponized by attackers.
In March 2026, BerryAI was also hit with a supply chain attack by TeamPCP, which resulted in the publishing of malicious LiteLLM versions on the Python Package Index (PyPI).
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/06/09/litellm-vulnerability-under-active-attack-cisa-warns-cve-2026-42271/