🛡️ CVE-2026-42271

The items that name it 7

• Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules
  writeup2026-10-09
• Vulnerability Discovery and Exploitation Trends in the AI Era (Google Cloud)
  article2026-09-30

  Command injection in BerriAI LiteLLM Model Context Protocol (MCP) server preview endpoint (POST /mcp-rest/test/connection), resulting in host takeover and API credential theft. Rated High Threat Risk; confirmed exploited in the wild.

• Inside 90 days of attacks on AI infrastructure
  writeup2026-08-27

  Command injection in LiteLLM's MCP server test endpoints; the command field in MCP stdio server test configurations is passed directly to subprocess execution with no validation, enabling remote code execution. Added to CISA KEV in June 2026.

• When AI infrastructure becomes the target: Securing gateways and control points | Microsoft Security Blog
  article2026-08-26It is written here as CVE-2026-42271: authenticated command-execution issue in LiteLLM MCP stdio test endpoints; chained with CVE-2026-48710 for unauthenticated RCE (Horizon3.ai public research).

  Horizon3.ai public research

• LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection
  writeup2026-08-03It is written here as CVE-2026-42271 (authenticated user can run commands on the LiteLLM host; added to CISA's KEV catalog, indicating exploitation in the wild).

  authenticated user can run commands on the LiteLLM host; added to CISA's KEV catalog, indicating exploitation in the wild

• LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE
  article

  Command injection vulnerability in BerriAI LiteLLM allowing any authenticated user to run arbitrary commands on the host; CVSS score 8.7. Added to CISA KEV catalog. Affects LiteLLM Python package >= 1.74.2, < 1.83.7. Root cause: POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpo

• CVE-2026-42271: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
  advisory

  LiteLLM proxy server vulnerability where POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints, used to preview an MCP server before saving it, accepted a full server configuration including command, args, and env fields for stdio transport. Calling them with a stdio configurat