LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE

What it is

CVE-2026-42271 (CVSS 8.7) — command injection in BerriAI LiteLLM, now in CISA's KEV catalog. Affected package versions are >= 1.74.2 and < 1.83.7. The chained partner is CVE-2026-48710 (CVSS 6.5), a Starlette "BadHost" host-header validation bypass affecting Starlette <= 1.0.0; chained, the two reach unauthenticated RCE (combined CVSS 10.0).

How it works

Two MCP preview endpoints — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accept a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio config, the endpoints attempt to connect, spawning the supplied command as a subprocess on the proxy host with the proxy process's privileges. The endpoints were gated only by a valid proxy API key, so any authenticated user (including internal-user keys) could execute commands. CVE-2026-48710 sidesteps LiteLLM's authentication entirely for deployments whose dependency tree includes Starlette <= 1.0.0, dropping the credential requirement.

What to do

Update LiteLLM to 1.83.7+ (both test endpoints now require the PROXY_ADMIN role, matching the save endpoint) and Starlette to 1.0.1+. If immediate patching isn't possible, the page gives specific stopgaps:

• Block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the reverse proxy or API gateway.
• Restrict network access to trusted segments.
• Rotate credentials stored by the proxy.
• Review logs for unusual Host header activity and subprocess execution events.

The last two detections map directly to the two bugs: Host-header anomalies flag the Starlette bypass; unexpected subprocess execution flags the command injection.

Caveats

The page states there is currently no information on how CVE-2026-42271 is being exploited in the wild — no threat actor, targeting, scope, or confirmed compromise — and it is unclear whether observed attacks use the full chain or just the authenticated command-injection bug. Treat the KEV listing as confirmation of exploitation of 42271, not of the unauthenticated chain. For context on urgency: the prior LiteLLM SQLi (CVE-2026-42208, CVSS 9.3) was exploited within 36 hours of public disclosure.