Skip to content

Back to the catalog

nvd.nist.govadvisory

CVE-2026-42271: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format

CVE-2026-42271 describes an unauthenticated-privilege RCE in LiteLLM (versions 1.74.2 to before 1.83.7): the MCP server preview endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list accept a full stdio MCP server config (command, args, env) and spawn it as a subprocess on the proxy host, gated only by a valid API key with no role check. Any authenticated user, including low-privilege internal-user keys, could run arbitrary commands on the LiteLLM proxy host. Patched in v1.83.7; also tracked as GHSA-v4p8-mg3p-g94g and affects Red Hat OpenShift AI.

TL;DR LiteLLM's MCP-server test/preview endpoints let any authenticated key spawn arbitrary subprocesses on the proxy host (CVE-2026-42271, CVSS 8.7), fixed in v1.83.7.
Open original ↗
Document

What it is

CVE-2026-42271 in LiteLLM (the OpenAI-format AI gateway proxy). The summary already carries the mechanism and version boundary; what the NVD page adds is the scoring and the Red Hat remediation surface. Published 2026-05-08, status Analyzed, classified under CWE-77 (command injection) and CWE-78 (OS command injection).

Severity

CVSS 4.0 base score 8.7 HIGH, vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:N/SA:N. Two details matter for prioritization beyond the summary's prose:

  • PR:L — privileges required is Low, confirming quantitatively that any valid API key (including internal-user keys) suffices; not a network-anonymous bug, but a very low bar.
  • AT:P — Attack Requirements is Present, meaning exploitation depends on a condition being met (here, the stdio-transport code path being reachable), not a guaranteed single-shot. This is why the score lands at 8.7 rather than higher despite full confidentiality/integrity/availability impact and a scope change (SC:H).

Affected / remediation

Affected products per NVD: litellm litellm and redhat openshift ai. If you run OpenShift AI, the fix ships through three separate Red Hat advisories, not one:

  • RHSA-2026:27784
  • RHSA-2026:28960
  • RHSA-2026:30056

Check which applies to your OpenShift AI channel/version rather than assuming a single errata covers you. Upstream fix is LiteLLM v1.83.7 (release tag v1.83.7-stable); tracked as GHSA-v4p8-mg3p-g94g. Red Hat's machine-readable VEX is at security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42271.json if you automate exposure triage.

Caveats

The page states no interim mitigation short of patching — it does not mention disabling the /mcp-rest/test/* preview endpoints or scoping API-key roles as a workaround. Treat upgrade (or the relevant RHSA) as the only stated remedy.

Organisations named here

  • CWE-77
  • CWE-78
  • GHSA-v4p8-mg3p-g94g

CVEs named here

  • CVE-2026-42271

Technologies named here

  • litellm litellm
  • LiteLLM
  • redhat openshift ai
  • Model Context Protocol

Techniques named here

  • OS Command Injection via stdio MCP server configuration

Related in AppSec