Read the docs
TI-2026-30582 Aliases CVE-2026-42271GHSA-v4p8-mg3p-g94g

LiteLLM: Authenticated command execution via MCP stdio test endpoints

Priority CRITICAL 97Exploited in the wildCWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.

Summary

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied command as a subprocess on the proxy host with the privileges of the proxy process. The endpoints were gated only by a valid proxy API key, with no role check. Any authenticated user — including holders of low-privilege internal-user keys — could therefore run arbitrary commands on the host. This issue has been patched in version 1.83.7.

Why it matters now

Exploitation Active In CISA KEV since 2026-06-08CISA due date 2026-06-22
EPSS 0.91445 99th percentileScored 2026-11-07
Fix Fixed litellm (BerriAI): 1.83.7litellm (PyPI): 1.83.7Red Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BerriAIlitellm1.74.2 to before 1.83.71.83.7Patch availableCNA
—litellm (PyPI)1.74.2 to before 1.83.71.83.7Patch availableGHSA-v4p8-mg3p-g94g
  • litellm VendorBerriAI Affected 1.74.2 to before 1.83.7 Fixed in 1.83.7 Patch available CNA
  • litellm (PyPI) Vendor— Affected 1.74.2 to before 1.83.7 Fixed in 1.83.7 Patch available GHSA-v4p8-mg3p-g94g

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:*1.74.2 to before 1.83.7VulnerableBerriAI
cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:*2.25 to before 2.25.8; 3.3 to before 3.3.4VulnerableRed Hat
cpe:2.3:a:redhat:openshift_ai:3.4:*:*:*:*:*:*:*3.4VulnerableRed Hat
  • cpe:2.3:a:litellm:litellm:*:*:*:*:*:*:*:* Versions 1.74.2 to before 1.83.7 Vulnerable ·BerriAI
  • cpe:2.3:a:redhat:openshift_ai:*:*:*:*:*:*:*:* Versions 2.25 to before 2.25.8; 3.3 to before 3.3.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_ai:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Red Hat

Remediation

  • Fix · CNA litellm (BerriAI) Fixed in 1.83.7
  • Fix · GHSA-v4p8-mg3p-g94g litellm (PyPI) Fixed in 1.83.7 Advisory →

Red Hat 3 advisories

  • RHSA-2026:30056 Released 2026-06-25 · Red Hat rating Important
    RHOAI 3.3.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-llama-stack-core-rhel9
  • RHSA-2026:28960 Released 2026-06-24 · Red Hat rating Important
    RHOAI 2.25.8 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-llama-stack-core-rhel9
  • RHSA-2026:27784 Released 2026-06-22 · Red Hat rating Important
    RHOAI 3.4.1 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI 2.25Fixed RHSA-2026:28960
Red Hat OpenShift AI 3.3Fixed RHSA-2026:30056
Red Hat OpenShift AI 3.4Fixed RHSA-2026:27784
Not affected: 6 products
  • Exploit Intelligence
  • Red Hat Ansible Automation Platform 2
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-06-08 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-42271
  3. 2026-10-03 Alias added: GHSA-v4p8-mg3p-g94g

References

Patch 1

Advisory 7

Other 3

  • TI-2026-26015 Trivy ecosystem supply chain briefly compromised KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-30529 LiteLLM: SQL injection in Proxy API key verification KEVCVSS 4.0CRITICAL 9.3
  • TI-2026-42639 LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback KEVCVSS 4.0HIGH 8.8
  • TI-2024-05340 Remote Code Execution in BerriAI/litellm CVSS 3.1CRITICAL 9.8
  • TI-2024-02760 Server-Side Template Injection in BerriAI/litellm CVSS 3.0CRITICAL 9.8
  • TI-2026-34701 LiteLLM < 1.83.10 Privilege Escalation via User Update CVSS 4.0HIGH 8.7
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences